capacitor-oidc 0.0.1-alpha.0

package/ios/Sources/CapacitorOidcPlugin/TokenVault.swift

@@ -0,0 +1,132 @@
+import Foundation
+import Security
+
+public enum TokenVaultAccessibility: Sendable {
+    case afterFirstUnlockThisDeviceOnly
+    case whenUnlockedThisDeviceOnly
+
+    var keychainValue: CFString {
+        switch self {
+        case .afterFirstUnlockThisDeviceOnly:
+            return kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+        case .whenUnlockedThisDeviceOnly:
+            return kSecAttrAccessibleWhenUnlockedThisDeviceOnly
+        }
+    }
+}
+
+public enum TokenVaultError: Error {
+    case keychain(OSStatus)
+    case invalidSession
+}
+
+public final class TokenVault: @unchecked Sendable {
+    public static let sessionSnapshotKey = "widget-session-v1"
+
+    private let service: String
+    private let accessGroup: String?
+    private let accessibility: TokenVaultAccessibility
+
+    public init(
+        service: String = "com.jojopirker.capacitor.oidc",
+        accessGroup: String? = nil,
+        accessibility: TokenVaultAccessibility = .afterFirstUnlockThisDeviceOnly
+    ) {
+        self.service = service
+        self.accessGroup = accessGroup
+        self.accessibility = accessibility
+    }
+
+    public func set(namespace: String, key: String, value: String) throws {
+        let data = Data(value.utf8)
+        let query = itemQuery(namespace: namespace, key: key)
+        let update: [CFString: Any] = [
+            kSecValueData: data,
+            kSecAttrAccessible: accessibility.keychainValue
+        ]
+        let status = SecItemUpdate(query as CFDictionary, update as CFDictionary)
+        if status == errSecSuccess { return }
+        if status != errSecItemNotFound { throw TokenVaultError.keychain(status) }
+
+        var item = query
+        item[kSecValueData as String] = data
+        item[kSecAttrAccessible as String] = accessibility.keychainValue
+        let addStatus = SecItemAdd(item as CFDictionary, nil)
+        guard addStatus == errSecSuccess else { throw TokenVaultError.keychain(addStatus) }
+    }
+
+    public func get(namespace: String, key: String) throws -> String? {
+        var query = itemQuery(namespace: namespace, key: key)
+        query[kSecReturnData as String] = true
+        query[kSecMatchLimit as String] = kSecMatchLimitOne
+
+        var result: CFTypeRef?
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        if status == errSecItemNotFound { return nil }
+        guard status == errSecSuccess, let data = result as? Data else {
+            throw TokenVaultError.keychain(status)
+        }
+        return String(data: data, encoding: .utf8)
+    }
+
+    @discardableResult
+    public func remove(namespace: String, key: String) throws -> String? {
+        let value = try get(namespace: namespace, key: key)
+        let status = SecItemDelete(itemQuery(namespace: namespace, key: key) as CFDictionary)
+        if status != errSecSuccess && status != errSecItemNotFound {
+            throw TokenVaultError.keychain(status)
+        }
+        return value
+    }
+
+    public func getAllKeys(namespace: String) throws -> [String] {
+        var query = baseQuery()
+        query[kSecReturnAttributes as String] = true
+        query[kSecMatchLimit as String] = kSecMatchLimitAll
+
+        var result: CFTypeRef?
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        if status == errSecItemNotFound { return [] }
+        guard status == errSecSuccess, let items = result as? [[String: Any]] else {
+            throw TokenVaultError.keychain(status)
+        }
+
+        let prefix = "\(namespace)."
+        return items.compactMap { item in
+            guard let account = item[kSecAttrAccount as String] as? String, account.hasPrefix(prefix) else { return nil }
+            return String(account.dropFirst(prefix.count))
+        }
+    }
+
+    public func setSessionSnapshot(namespace: String, value: String?) throws {
+        if let value {
+            try set(namespace: namespace, key: Self.sessionSnapshotKey, value: value)
+        } else {
+            try remove(namespace: namespace, key: Self.sessionSnapshotKey)
+        }
+    }
+
+    public func loadSession(namespace: String) throws -> StoredSessionV1? {
+        guard let value = try get(namespace: namespace, key: Self.sessionSnapshotKey),
+              let data = value.data(using: .utf8) else { return nil }
+        let session = try JSONDecoder().decode(StoredSessionV1.self, from: data)
+        guard session.version == 1 else { throw TokenVaultError.invalidSession }
+        return session
+    }
+
+    private func baseQuery() -> [String: Any] {
+        var query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecAttrSynchronizable as String: false
+        ]
+        if let accessGroup { query[kSecAttrAccessGroup as String] = accessGroup }
+        return query
+    }
+
+    private func itemQuery(namespace: String, key: String) -> [String: Any] {
+        var query = baseQuery()
+        query[kSecAttrAccount as String] = "\(namespace).\(key)"
+        return query
+    }
+}

package/ios/Tests/CapacitorOidcPluginTests/StoredSessionV1Tests.swift

@@ -0,0 +1,38 @@
+import XCTest
+@testable import CapacitorOidcPlugin
+
+final class StoredSessionV1Tests: XCTestCase {
+    func testDecodesSharedFixture() throws {
+        let fixtureURL = URL(fileURLWithPath: #filePath)
+            .deletingLastPathComponent()
+            .deletingLastPathComponent()
+            .deletingLastPathComponent()
+            .deletingLastPathComponent()
+            .appendingPathComponent("contracts/fixtures/stored-session-v1.json")
+        let session = try JSONDecoder().decode(StoredSessionV1.self, from: Data(contentsOf: fixtureURL))
+
+        XCTAssertEqual(session.version, 1)
+        XCTAssertEqual(session.issuer, "https://issuer.example")
+        XCTAssertEqual(session.clientId, "mobile")
+        XCTAssertEqual(session.accessToken, "access")
+        XCTAssertEqual(session.refreshToken, "refresh")
+        XCTAssertEqual(session.idToken, "id-token")
+        XCTAssertEqual(session.tokenType, "Bearer")
+        XCTAssertEqual(session.scope, "openid profile offline_access")
+        XCTAssertEqual(session.expiresAt, 1_800_000_000)
+    }
+
+    func testRoundTrip() throws {
+        let session = StoredSessionV1(
+            issuer: "https://issuer.example",
+            clientId: "mobile",
+            accessToken: "access",
+            refreshToken: "refresh",
+            tokenType: "Bearer",
+            expiresAt: 1_800_000_000
+        )
+
+        let decoded = try JSONDecoder().decode(StoredSessionV1.self, from: JSONEncoder().encode(session))
+        XCTAssertEqual(decoded, session)
+    }
+}

package/package.json

@@ -0,0 +1,85 @@
+{
+  "name": "capacitor-oidc",
+  "version": "0.0.1-alpha.0",
+  "description": "A minimal Capacitor adapter for standards-based OpenID Connect authentication.",
+  "main": "dist/plugin.cjs",
+  "module": "dist/esm/index.js",
+  "types": "dist/esm/index.d.ts",
+  "files": [
+    "android/src/main/",
+    "android/build.gradle",
+    "dist/",
+    "ios/Sources",
+    "ios/Tests",
+    "Package.swift",
+    "CapacitorOidc.podspec"
+  ],
+  "license": "Apache-2.0",
+  "author": {
+    "name": "Jojo Pirker",
+    "email": "j.pirker@gmail.com"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/jojopirker/capacitor-oidc.git"
+  },
+  "bugs": {
+    "url": "https://github.com/jojopirker/capacitor-oidc/issues"
+  },
+  "homepage": "https://github.com/jojopirker/capacitor-oidc#readme",
+  "type": "module",
+  "scripts": {
+    "build": "npm run clean && tsc && rollup -c rollup.config.mjs",
+    "clean": "rimraf dist",
+    "check:contract": "node scripts/generate-native-contract.mjs --check",
+    "generate:contract": "node scripts/generate-native-contract.mjs",
+    "lint": "eslint src --ext ts && prettier --check src scripts contracts package.json README.md SECURITY.md docs",
+    "prepack": "npm run build",
+    "test": "vitest run",
+    "verify": "npm run check:contract && npm run lint && npm run test && npm run build",
+    "verify:ios": "xcodebuild -scheme CapacitorOidc -destination generic/platform=iOS CODE_SIGNING_ALLOWED=NO",
+    "verify:android": "cd android && ./gradlew clean test assembleDebug"
+  },
+  "dependencies": {
+    "oidc-client-ts": "3.5.0"
+  },
+  "peerDependencies": {
+    "@capacitor/app": "^8.0.0",
+    "@capacitor/core": "^8.0.0"
+  },
+  "devDependencies": {
+    "@capacitor/android": "8.5.0",
+    "@capacitor/app": "8.1.1",
+    "@capacitor/core": "8.5.0",
+    "@capacitor/ios": "8.5.0",
+    "@ionic/eslint-config": "0.4.0",
+    "@ionic/prettier-config": "4.0.0",
+    "@types/node": "24.5.2",
+    "eslint": "8.57.1",
+    "prettier": "3.6.2",
+    "rimraf": "6.1.0",
+    "rollup": "4.62.5",
+    "typescript": "5.9.3",
+    "vitest": "3.2.7"
+  },
+  "prettier": "@ionic/prettier-config",
+  "eslintConfig": {
+    "extends": "@ionic/eslint-config/recommended",
+    "rules": {
+      "@typescript-eslint/no-unused-vars": [
+        "error",
+        {
+          "argsIgnorePattern": "^_"
+        }
+      ]
+    }
+  },
+  "capacitor": {
+    "ios": {
+      "src": "ios"
+    },
+    "android": {
+      "src": "android"
+    }
+  }
+}