capacitor-oidc 0.0.1-alpha.0

package/android/src/main/java/com/jojopirker/capacitor/oidc/CapacitorOidcPlugin.java

@@ -0,0 +1,240 @@
+package com.jojopirker.capacitor.oidc;
+
+import android.content.ActivityNotFoundException;
+import android.content.Intent;
+import android.net.Uri;
+import androidx.activity.result.ActivityResultLauncher;
+import androidx.browser.auth.AuthTabIntent;
+import com.getcapacitor.JSArray;
+import com.getcapacitor.JSObject;
+import com.getcapacitor.Plugin;
+import com.getcapacitor.PluginCall;
+import com.getcapacitor.PluginMethod;
+import com.getcapacitor.annotation.CapacitorPlugin;
+import java.io.IOException;
+import java.security.GeneralSecurityException;
+import java.util.List;
+import org.json.JSONObject;
+
+@CapacitorPlugin(name = NativeContract.PLUGIN_NAME)
+public final class CapacitorOidcPlugin extends Plugin {
+
+    private ActivityResultLauncher<Intent> authLauncher;
+    private PluginCall pendingAuthCall;
+    private Uri pendingCallback;
+    private TokenVault vault;
+
+    @Override
+    public void load() {
+        vault = new TokenVault(getContext());
+        authLauncher = bridge.registerForActivityResult(new AuthTabIntent.AuthenticateUserResultContract(), this::handleAuthResult);
+    }
+
+    @PluginMethod
+    public void configure(PluginCall call) {
+        call.resolve();
+    }
+
+    @PluginMethod
+    public void open(PluginCall call) {
+        if (pendingAuthCall != null) {
+            call.reject("An authentication session is already active.", NativeContract.ERROR_AUTH_SESSION_IN_PROGRESS);
+            return;
+        }
+
+        String urlValue = requiredString(call, NativeContract.FIELD_URL);
+        String callbackValue = requiredString(call, NativeContract.FIELD_CALLBACK_URL);
+        if (urlValue == null || callbackValue == null) return;
+
+        Uri url = Uri.parse(urlValue);
+        Uri callback = Uri.parse(callbackValue);
+        if (!isSecureRequestUrl(url)) {
+            call.reject("The authentication URL must use HTTPS outside loopback development.", NativeContract.ERROR_BROWSER_UNAVAILABLE);
+            return;
+        }
+        if (!isSupportedCallback(callback)) {
+            call.reject("The callback URL must use HTTPS or a custom scheme.", NativeContract.ERROR_INVALID_CALLBACK);
+            return;
+        }
+
+        boolean ephemeral = Boolean.TRUE.equals(call.getBoolean(NativeContract.FIELD_PREFERS_EPHEMERAL_WEB_BROWSER_SESSION, false));
+        AuthTabIntent authTab = new AuthTabIntent.Builder().setEphemeralBrowsingEnabled(ephemeral).build();
+        pendingAuthCall = call;
+        pendingCallback = callback;
+
+        try {
+            if ("https".equalsIgnoreCase(callback.getScheme())) {
+                authTab.launch(authLauncher, url, callback.getHost(), path(callback));
+            } else {
+                authTab.launch(authLauncher, url, callback.getScheme());
+            }
+        } catch (ActivityNotFoundException | IllegalStateException error) {
+            clearPendingAuth();
+            call.reject("No compatible system browser is available.", NativeContract.ERROR_BROWSER_UNAVAILABLE);
+        }
+    }
+
+    @PluginMethod
+    public void cancel(PluginCall call) {
+        PluginCall authCall = pendingAuthCall;
+        clearPendingAuth();
+        if (authCall != null) authCall.reject("The authentication session was cancelled.", NativeContract.ERROR_USER_CANCELLED);
+        call.resolve();
+    }
+
+    @Override
+    protected void handleOnNewIntent(Intent intent) {
+        Uri callback = intent.getData();
+        PluginCall call = pendingAuthCall;
+        if (call == null || callback == null || !CallbackUriMatcher.matches(callback, pendingCallback)) return;
+
+        clearPendingAuth();
+        JSObject response = new JSObject();
+        response.put(NativeContract.FIELD_URL, callback.toString());
+        call.resolve(response);
+    }
+
+    @PluginMethod
+    public void storageSet(PluginCall call) {
+        String namespace = requiredString(call, NativeContract.FIELD_NAMESPACE);
+        String key = requiredString(call, NativeContract.FIELD_KEY);
+        String value = call.getString(NativeContract.FIELD_VALUE);
+        if (namespace == null || key == null) return;
+        if (value == null) {
+            call.reject("value is required.");
+            return;
+        }
+
+        try {
+            vault.set(namespace, key, value);
+            call.resolve();
+        } catch (GeneralSecurityException | IOException error) {
+            rejectStorage(call);
+        }
+    }
+
+    @PluginMethod
+    public void storageGet(PluginCall call) {
+        String namespace = requiredString(call, NativeContract.FIELD_NAMESPACE);
+        String key = requiredString(call, NativeContract.FIELD_KEY);
+        if (namespace == null || key == null) return;
+
+        try {
+            resolveValue(call, vault.get(namespace, key));
+        } catch (GeneralSecurityException | IOException error) {
+            rejectStorage(call);
+        }
+    }
+
+    @PluginMethod
+    public void storageRemove(PluginCall call) {
+        String namespace = requiredString(call, NativeContract.FIELD_NAMESPACE);
+        String key = requiredString(call, NativeContract.FIELD_KEY);
+        if (namespace == null || key == null) return;
+
+        try {
+            resolveValue(call, vault.remove(namespace, key));
+        } catch (GeneralSecurityException | IOException error) {
+            rejectStorage(call);
+        }
+    }
+
+    @PluginMethod
+    public void storageGetAllKeys(PluginCall call) {
+        String namespace = requiredString(call, NativeContract.FIELD_NAMESPACE);
+        if (namespace == null) return;
+
+        try {
+            List<String> keys = vault.getAllKeys(namespace);
+            JSObject result = new JSObject();
+            result.put(NativeContract.FIELD_KEYS, new JSArray(keys));
+            call.resolve(result);
+        } catch (GeneralSecurityException | IOException error) {
+            rejectStorage(call);
+        }
+    }
+
+    @PluginMethod
+    public void setSessionSnapshot(PluginCall call) {
+        String namespace = requiredString(call, NativeContract.FIELD_NAMESPACE);
+        if (namespace == null) return;
+
+        try {
+            vault.setSessionSnapshot(namespace, call.getString(NativeContract.FIELD_VALUE));
+            call.resolve();
+        } catch (GeneralSecurityException | IOException error) {
+            rejectStorage(call);
+        }
+    }
+
+    private void handleAuthResult(AuthTabIntent.AuthResult result) {
+        PluginCall call = pendingAuthCall;
+        Uri expectedCallback = pendingCallback;
+        clearPendingAuth();
+        if (call == null) return;
+
+        if (result.resultCode == AuthTabIntent.RESULT_CANCELED) {
+            call.reject("The authentication session was cancelled.", NativeContract.ERROR_USER_CANCELLED);
+            return;
+        }
+        if (result.resultCode != AuthTabIntent.RESULT_OK || result.resultUri == null) {
+            call.reject("The browser did not return a valid callback.", NativeContract.ERROR_INVALID_CALLBACK);
+            return;
+        }
+        if (!CallbackUriMatcher.matches(result.resultUri, expectedCallback)) {
+            call.reject("The authentication callback does not match the configured redirect URL.", NativeContract.ERROR_INVALID_CALLBACK);
+            return;
+        }
+
+        JSObject response = new JSObject();
+        response.put(NativeContract.FIELD_URL, result.resultUri.toString());
+        call.resolve(response);
+    }
+
+    private void clearPendingAuth() {
+        pendingAuthCall = null;
+        pendingCallback = null;
+    }
+
+    private static String requiredString(PluginCall call, String name) {
+        String value = call.getString(name);
+        if (value == null || value.isEmpty()) {
+            call.reject(name + " is required.");
+            return null;
+        }
+        return value;
+    }
+
+    private static boolean isSecureRequestUrl(Uri uri) {
+        String scheme = uri.getScheme();
+        String host = uri.getHost();
+        if (host == null) return false;
+        if ("https".equalsIgnoreCase(scheme)) return true;
+        return "http".equalsIgnoreCase(scheme) &&
+        ("localhost".equalsIgnoreCase(host) ||
+            "127.0.0.1".equals(host) ||
+            "::1".equals(host) ||
+            "[::1]".equals(host));
+    }
+
+    private static boolean isSupportedCallback(Uri uri) {
+        String scheme = uri.getScheme();
+        if (scheme == null || scheme.isEmpty() || "http".equalsIgnoreCase(scheme)) return false;
+        return !"https".equalsIgnoreCase(scheme) || uri.getHost() != null;
+    }
+
+    private static String path(Uri uri) {
+        String path = uri.getPath();
+        return path == null ? "" : path;
+    }
+
+    private static void resolveValue(PluginCall call, String value) {
+        JSObject result = new JSObject();
+        result.put(NativeContract.FIELD_VALUE, value == null ? JSONObject.NULL : value);
+        call.resolve(result);
+    }
+
+    private static void rejectStorage(PluginCall call) {
+        call.reject("Secure storage failed.", NativeContract.ERROR_SECURE_STORAGE_ERROR);
+    }
+}

package/android/src/main/java/com/jojopirker/capacitor/oidc/NativeContract.java

@@ -0,0 +1,35 @@
+// Generated by scripts/generate-native-contract.mjs. Do not edit.
+package com.jojopirker.capacitor.oidc;
+
+final class NativeContract {
+
+    static final String PLUGIN_NAME = "CapacitorOidc";
+
+    static final String METHOD_CONFIGURE = "configure";
+    static final String METHOD_OPEN = "open";
+    static final String METHOD_CANCEL = "cancel";
+    static final String METHOD_STORAGE_SET = "storageSet";
+    static final String METHOD_STORAGE_GET = "storageGet";
+    static final String METHOD_STORAGE_REMOVE = "storageRemove";
+    static final String METHOD_STORAGE_GET_ALL_KEYS = "storageGetAllKeys";
+    static final String METHOD_SET_SESSION_SNAPSHOT = "setSessionSnapshot";
+    static final String FIELD_URL = "url";
+    static final String FIELD_CALLBACK_URL = "callbackUrl";
+    static final String FIELD_PREFERS_EPHEMERAL_WEB_BROWSER_SESSION = "prefersEphemeralWebBrowserSession";
+    static final String FIELD_KEYCHAIN_ACCESS_GROUP = "keychainAccessGroup";
+    static final String FIELD_KEYCHAIN_ACCESSIBILITY = "keychainAccessibility";
+    static final String FIELD_NAMESPACE = "namespace";
+    static final String FIELD_KEY = "key";
+    static final String FIELD_VALUE = "value";
+    static final String FIELD_KEYS = "keys";
+    static final String ERROR_AUTH_SESSION_IN_PROGRESS = "AUTH_SESSION_IN_PROGRESS";
+    static final String ERROR_USER_CANCELLED = "USER_CANCELLED";
+    static final String ERROR_BROWSER_UNAVAILABLE = "BROWSER_UNAVAILABLE";
+    static final String ERROR_INVALID_CALLBACK = "INVALID_CALLBACK";
+    static final String ERROR_SECURE_STORAGE_ERROR = "SECURE_STORAGE_ERROR";
+    static final String ERROR_UNSUPPORTED_RUNTIME = "UNSUPPORTED_RUNTIME";
+    static final String KEYCHAIN_ACCESSIBILITY_AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY = "afterFirstUnlockThisDeviceOnly";
+    static final String KEYCHAIN_ACCESSIBILITY_WHEN_UNLOCKED_THIS_DEVICE_ONLY = "whenUnlockedThisDeviceOnly";
+
+    private NativeContract() {}
+}

package/android/src/main/java/com/jojopirker/capacitor/oidc/StoredSessionV1.java

@@ -0,0 +1,111 @@
+package com.jojopirker.capacitor.oidc;
+
+import org.json.JSONException;
+import org.json.JSONObject;
+
+/** Versioned session data readable by an Android widget in the host application. */
+public final class StoredSessionV1 {
+
+    public static final int VERSION = 1;
+
+    private final String issuer;
+    private final String clientId;
+    private final String accessToken;
+    private final String refreshToken;
+    private final String idToken;
+    private final String tokenType;
+    private final String scope;
+    private final Long expiresAt;
+
+    public StoredSessionV1(
+        String issuer,
+        String clientId,
+        String accessToken,
+        String refreshToken,
+        String idToken,
+        String tokenType,
+        String scope,
+        Long expiresAt
+    ) {
+        this.issuer = issuer;
+        this.clientId = clientId;
+        this.accessToken = accessToken;
+        this.refreshToken = refreshToken;
+        this.idToken = idToken;
+        this.tokenType = tokenType;
+        this.scope = scope;
+        this.expiresAt = expiresAt;
+    }
+
+    public static StoredSessionV1 fromJson(String value) throws JSONException {
+        JSONObject json = new JSONObject(value);
+        if (json.getInt("version") != VERSION) {
+            throw new JSONException("Unsupported session version");
+        }
+
+        return new StoredSessionV1(
+            json.getString("issuer"),
+            json.getString("clientId"),
+            json.getString("accessToken"),
+            optionalString(json, "refreshToken"),
+            optionalString(json, "idToken"),
+            json.getString("tokenType"),
+            optionalString(json, "scope"),
+            json.has("expiresAt") ? json.getLong("expiresAt") : null
+        );
+    }
+
+    public String toJson() throws JSONException {
+        JSONObject json = new JSONObject();
+        json.put("version", VERSION);
+        json.put("issuer", issuer);
+        json.put("clientId", clientId);
+        json.put("accessToken", accessToken);
+        putOptional(json, "refreshToken", refreshToken);
+        putOptional(json, "idToken", idToken);
+        json.put("tokenType", tokenType);
+        putOptional(json, "scope", scope);
+        if (expiresAt != null) json.put("expiresAt", expiresAt);
+        return json.toString();
+    }
+
+    public String getIssuer() {
+        return issuer;
+    }
+
+    public String getClientId() {
+        return clientId;
+    }
+
+    public String getAccessToken() {
+        return accessToken;
+    }
+
+    public String getRefreshToken() {
+        return refreshToken;
+    }
+
+    public String getIdToken() {
+        return idToken;
+    }
+
+    public String getTokenType() {
+        return tokenType;
+    }
+
+    public String getScope() {
+        return scope;
+    }
+
+    public Long getExpiresAt() {
+        return expiresAt;
+    }
+
+    private static String optionalString(JSONObject json, String key) throws JSONException {
+        return json.has(key) && !json.isNull(key) ? json.getString(key) : null;
+    }
+
+    private static void putOptional(JSONObject json, String key, String value) throws JSONException {
+        if (value != null) json.put(key, value);
+    }
+}

package/android/src/main/java/com/jojopirker/capacitor/oidc/TokenVault.java

@@ -0,0 +1,209 @@
+package com.jojopirker.capacitor.oidc;
+
+import android.content.Context;
+import android.security.keystore.KeyGenParameterSpec;
+import android.security.keystore.KeyProperties;
+import android.util.AtomicFile;
+import android.util.Base64;
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.DataInputStream;
+import java.io.DataOutputStream;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.security.GeneralSecurityException;
+import java.security.KeyStore;
+import java.security.MessageDigest;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+import javax.crypto.Cipher;
+import javax.crypto.KeyGenerator;
+import javax.crypto.SecretKey;
+import javax.crypto.spec.GCMParameterSpec;
+import org.json.JSONException;
+
+/**
+ * App-private token storage that can also be used directly by a widget in the host application.
+ * Values are encrypted with an AES-GCM key held by Android Keystore.
+ */
+public final class TokenVault {
+
+    private static final String KEY_STORE = "AndroidKeyStore";
+    private static final String KEY_ALIAS = "com.jojopirker.capacitor.oidc.token-vault.v1";
+    private static final String CIPHER = "AES/GCM/NoPadding";
+    private static final int MAGIC = 0x434f4944;
+    private static final int FORMAT_VERSION = 1;
+    private static final String FILE_EXTENSION = ".vault";
+    private static final String SNAPSHOT_KEY = "current";
+    private static final String SNAPSHOT_NAMESPACE_PREFIX = "session-snapshot:";
+
+    private final File rootDirectory;
+
+    public TokenVault(Context context) {
+        rootDirectory = new File(context.getNoBackupFilesDir(), "capacitor-oidc");
+    }
+
+    public synchronized void set(String namespace, String key, String value) throws GeneralSecurityException, IOException {
+        File file = entryFile(namespace, key, true);
+        byte[] plaintext = VaultEntryCodec.encode(key, value);
+        Cipher cipher = Cipher.getInstance(CIPHER);
+        cipher.init(Cipher.ENCRYPT_MODE, getOrCreateKey());
+        cipher.updateAAD(aad(namespace));
+        byte[] ciphertext = cipher.doFinal(plaintext);
+        write(file, cipher.getIV(), ciphertext);
+    }
+
+    public synchronized String get(String namespace, String key) throws GeneralSecurityException, IOException {
+        File file = entryFile(namespace, key, false);
+        if (!file.exists()) return null;
+        VaultEntryCodec.Entry entry = decrypt(namespace, file);
+        if (!entry.key.equals(key)) throw new GeneralSecurityException("Vault key mismatch");
+        return entry.value;
+    }
+
+    public synchronized String remove(String namespace, String key) throws GeneralSecurityException, IOException {
+        String value = get(namespace, key);
+        if (value != null) new AtomicFile(entryFile(namespace, key, false)).delete();
+        return value;
+    }
+
+    public synchronized List<String> getAllKeys(String namespace) throws GeneralSecurityException, IOException {
+        File directory = namespaceDirectory(namespace);
+        File[] files = directory.listFiles((ignored, name) -> name.endsWith(FILE_EXTENSION));
+        if (files == null) return Collections.emptyList();
+
+        Arrays.sort(files);
+        List<String> keys = new ArrayList<>(files.length);
+        for (File file : files) keys.add(decrypt(namespace, file).key);
+        Collections.sort(keys);
+        return keys;
+    }
+
+    public synchronized void setSessionSnapshot(String namespace, String value) throws GeneralSecurityException, IOException {
+        String snapshotNamespace = SNAPSHOT_NAMESPACE_PREFIX + namespace;
+        if (value == null) {
+            remove(snapshotNamespace, SNAPSHOT_KEY);
+        } else {
+            set(snapshotNamespace, SNAPSHOT_KEY, value);
+        }
+    }
+
+    public synchronized String getSessionSnapshot(String namespace) throws GeneralSecurityException, IOException {
+        return get(SNAPSHOT_NAMESPACE_PREFIX + namespace, SNAPSHOT_KEY);
+    }
+
+    public synchronized StoredSessionV1 loadSession(String namespace) throws GeneralSecurityException, IOException, JSONException {
+        String value = getSessionSnapshot(namespace);
+        return value == null ? null : StoredSessionV1.fromJson(value);
+    }
+
+    private VaultEntryCodec.Entry decrypt(String namespace, File file) throws GeneralSecurityException, IOException {
+        EncryptedValue encrypted = read(file);
+        Cipher cipher = Cipher.getInstance(CIPHER);
+        cipher.init(Cipher.DECRYPT_MODE, getOrCreateKey(), new GCMParameterSpec(128, encrypted.iv));
+        cipher.updateAAD(aad(namespace));
+        return VaultEntryCodec.decode(cipher.doFinal(encrypted.ciphertext));
+    }
+
+    private static synchronized SecretKey getOrCreateKey() throws GeneralSecurityException, IOException {
+        KeyStore keyStore = KeyStore.getInstance(KEY_STORE);
+        keyStore.load(null);
+        SecretKey key = (SecretKey) keyStore.getKey(KEY_ALIAS, null);
+        if (key != null) return key;
+
+        KeyGenerator generator = KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, KEY_STORE);
+        generator.init(
+            new KeyGenParameterSpec.Builder(KEY_ALIAS, KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT)
+                .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
+                .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
+                .setKeySize(256)
+                .build()
+        );
+        return generator.generateKey();
+    }
+
+    private File entryFile(String namespace, String key, boolean createDirectory) throws GeneralSecurityException, IOException {
+        File directory = namespaceDirectory(namespace);
+        if (createDirectory && !directory.exists() && !directory.mkdirs()) {
+            throw new IOException("Unable to create vault directory");
+        }
+        return new File(directory, digest(key) + FILE_EXTENSION);
+    }
+
+    private File namespaceDirectory(String namespace) throws GeneralSecurityException {
+        return new File(rootDirectory, digest("namespace\u0000" + namespace));
+    }
+
+    private static String digest(String value) throws GeneralSecurityException {
+        byte[] hash = MessageDigest.getInstance("SHA-256").digest(value.getBytes(StandardCharsets.UTF_8));
+        return Base64.encodeToString(hash, Base64.URL_SAFE | Base64.NO_WRAP | Base64.NO_PADDING);
+    }
+
+    private static byte[] aad(String namespace) {
+        return ("capacitor-oidc-v1\u0000" + namespace).getBytes(StandardCharsets.UTF_8);
+    }
+
+    private static void write(File file, byte[] iv, byte[] ciphertext) throws IOException {
+        ByteArrayOutputStream bytes = new ByteArrayOutputStream(iv.length + ciphertext.length + 10);
+        DataOutputStream data = new DataOutputStream(bytes);
+        data.writeInt(MAGIC);
+        data.writeByte(FORMAT_VERSION);
+        data.writeByte(iv.length);
+        data.write(iv);
+        data.writeInt(ciphertext.length);
+        data.write(ciphertext);
+
+        AtomicFile atomicFile = new AtomicFile(file);
+        FileOutputStream output = atomicFile.startWrite();
+        try {
+            output.write(bytes.toByteArray());
+            atomicFile.finishWrite(output);
+        } catch (IOException error) {
+            atomicFile.failWrite(output);
+            throw error;
+        }
+    }
+
+    private static EncryptedValue read(File file) throws IOException {
+        AtomicFile atomicFile = new AtomicFile(file);
+        byte[] bytes;
+        try (FileInputStream input = atomicFile.openRead(); ByteArrayOutputStream output = new ByteArrayOutputStream()) {
+            byte[] buffer = new byte[4096];
+            int count;
+            while ((count = input.read(buffer)) != -1) output.write(buffer, 0, count);
+            bytes = output.toByteArray();
+        }
+
+        DataInputStream data = new DataInputStream(new ByteArrayInputStream(bytes));
+        if (data.readInt() != MAGIC || data.readUnsignedByte() != FORMAT_VERSION) {
+            throw new IOException("Unsupported vault format");
+        }
+
+        int ivLength = data.readUnsignedByte();
+        byte[] iv = new byte[ivLength];
+        data.readFully(iv);
+        int ciphertextLength = data.readInt();
+        if (ciphertextLength < 0 || ciphertextLength != data.available()) {
+            throw new IOException("Invalid vault entry");
+        }
+        byte[] ciphertext = new byte[ciphertextLength];
+        data.readFully(ciphertext);
+        return new EncryptedValue(iv, ciphertext);
+    }
+
+    private static final class EncryptedValue {
+
+        final byte[] iv;
+        final byte[] ciphertext;
+
+        EncryptedValue(byte[] iv, byte[] ciphertext) {
+            this.iv = iv;
+            this.ciphertext = ciphertext;
+        }
+    }
+}

package/android/src/main/java/com/jojopirker/capacitor/oidc/VaultEntryCodec.java

@@ -0,0 +1,56 @@
+package com.jojopirker.capacitor.oidc;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.DataInputStream;
+import java.io.DataOutputStream;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+
+final class VaultEntryCodec {
+
+    private VaultEntryCodec() {}
+
+    static byte[] encode(String key, String value) throws IOException {
+        byte[] keyBytes = key.getBytes(StandardCharsets.UTF_8);
+        byte[] valueBytes = value.getBytes(StandardCharsets.UTF_8);
+        ByteArrayOutputStream bytes = new ByteArrayOutputStream(keyBytes.length + valueBytes.length + 8);
+        DataOutputStream output = new DataOutputStream(bytes);
+        output.writeInt(keyBytes.length);
+        output.write(keyBytes);
+        output.writeInt(valueBytes.length);
+        output.write(valueBytes);
+        return bytes.toByteArray();
+    }
+
+    static Entry decode(byte[] bytes) throws IOException {
+        DataInputStream input = new DataInputStream(new ByteArrayInputStream(bytes));
+        int keyLength = input.readInt();
+        if (keyLength < 0 || keyLength > input.available() - 4) {
+            throw new IOException("Invalid vault entry");
+        }
+
+        byte[] keyBytes = new byte[keyLength];
+        input.readFully(keyBytes);
+
+        int valueLength = input.readInt();
+        if (valueLength < 0 || valueLength != input.available()) {
+            throw new IOException("Invalid vault entry");
+        }
+
+        byte[] valueBytes = new byte[valueLength];
+        input.readFully(valueBytes);
+        return new Entry(new String(keyBytes, StandardCharsets.UTF_8), new String(valueBytes, StandardCharsets.UTF_8));
+    }
+
+    static final class Entry {
+
+        final String key;
+        final String value;
+
+        Entry(String key, String value) {
+            this.key = key;
+            this.value = value;
+        }
+    }
+}

package/dist/esm/capacitor-navigator.d.ts

@@ -0,0 +1,14 @@
+import type { INavigator, IWindow } from 'oidc-client-ts';
+export declare class CapacitorNavigator implements INavigator {
+    private readonly prefersEphemeralWebBrowserSession;
+    constructor(prefersEphemeralWebBrowserSession: boolean);
+    prepare(): Promise<IWindow>;
+    callback(): Promise<void>;
+}
+export declare function assertSecureRequestUrl(requestUrl: string): void;
+export declare function callbackUrlFromRequest(requestUrl: string): string;
+export declare function isExpectedCallback(actualValue: string, expectedValue: string): boolean;
+export declare class UnsupportedIframeNavigator implements INavigator {
+    prepare(): Promise<IWindow>;
+    callback(): Promise<void>;
+}