expo-device-crypto 1.1.0 → 1.2.0

package/android/build.gradle

@@ -4,13 +4,13 @@ plugins {
 }
 
 group = 'expo.modules.devicecrypto'
-version = '1.1.0'
+version = '1.2.0'
 
 android {
   namespace "expo.modules.devicecrypto"
   defaultConfig {
     versionCode 1
-    versionName "1.1.0"
+    versionName "1.2.0"
   }
   lintOptions {
     abortOnError false

package/android/src/main/java/expo/modules/devicecrypto/{DeviceCryptoModule.kt → DeviceCrypto.kt}

@@ -139,6 +139,7 @@ class DeviceCryptoModule : Module() {
     alias: String, 
     digest: String?,
     reqAuth: Boolean,
+    reqUnlocked: Boolean,
     strongBox: Boolean): KeyPairGenerator {
     val kpg: KeyPairGenerator = KeyPairGenerator.getInstance(
       KEY_ALGORITHM_EC,
@@ -154,6 +155,7 @@ class DeviceCryptoModule : Module() {
       }
       setIsStrongBoxBacked(strongBox)
       setUserAuthenticationRequired(reqAuth)
+      setUnlockedDeviceRequired(reqUnlocked)
       if (reqAuth) {
         setUserAuthenticationParameters(
           30, // 30 seconds
@@ -173,6 +175,7 @@ class DeviceCryptoModule : Module() {
     padding: String?,
     keySize: Int,
     reqAuth: Boolean,
+    reqUnlocked: Boolean,
     strongBox: Boolean): KeyPairGenerator {
     val kpg: KeyPairGenerator = KeyPairGenerator.getInstance(
       KEY_ALGORITHM_RSA,
@@ -198,6 +201,7 @@ class DeviceCryptoModule : Module() {
       setIsStrongBoxBacked(strongBox)
       setKeySize(keySize)
       setUserAuthenticationRequired(reqAuth)
+      setUnlockedDeviceRequired(reqUnlocked)
       if (reqAuth) {
         setUserAuthenticationParameters(
           30, // 30 seconds
@@ -214,6 +218,7 @@ class DeviceCryptoModule : Module() {
     alias: String,
     digest: String?,
     reqAuth: Boolean,
+    reqUnlocked: Boolean,
     strongBox: Boolean): KeyPairGenerator {
     val kpg: KeyPairGenerator = KeyPairGenerator.getInstance(
       KEY_ALGORITHM_EC,
@@ -229,6 +234,7 @@ class DeviceCryptoModule : Module() {
       }
       setIsStrongBoxBacked(strongBox)
       setUserAuthenticationRequired(reqAuth)
+      setUnlockedDeviceRequired(reqUnlocked)
       if (reqAuth) {
         setUserAuthenticationParameters(
           30, // 30 seconds
@@ -305,6 +311,7 @@ class DeviceCryptoModule : Module() {
 
   private fun generateKeyPair(alias: String, o: Map<String, Any?>): GenerateKeyPairResult {
     val reqAuth = o["reqAuth"] as Boolean
+    val reqUnlocked = o["reqUnlocked"] as Boolean
     if (reqAuth && isAuthCheckAvailable() != AuthCheckResult.AVAILABLE) {
       throw Exception("NO_AUTH_AVAILABLE")
     }
@@ -324,6 +331,7 @@ class DeviceCryptoModule : Module() {
         alias = alias,
         digest = DIGEST_SHA256,
         reqAuth = reqAuth,
+        reqUnlocked = reqUnlocked,
         strongBox = strongBox
       )
       AlgorithmType.RSA_2048_PKCS1 -> buildRSA(
@@ -333,6 +341,7 @@ class DeviceCryptoModule : Module() {
         padding = ENCRYPTION_PADDING_RSA_PKCS1,
         keySize = 2048,
         reqAuth = reqAuth,
+        reqUnlocked = reqUnlocked,
         strongBox = strongBox
       )
       AlgorithmType.RSA_2048_OAEP_SHA1 -> buildRSA(
@@ -342,6 +351,7 @@ class DeviceCryptoModule : Module() {
         padding = ENCRYPTION_PADDING_RSA_OAEP,
         keySize = 2048,
         reqAuth = reqAuth,
+        reqUnlocked = reqUnlocked,
         strongBox = strongBox
       )
       AlgorithmType.RSA_4096_PKCS1 -> buildRSA(
@@ -351,6 +361,7 @@ class DeviceCryptoModule : Module() {
         padding = ENCRYPTION_PADDING_RSA_PKCS1,
         keySize = 4096,
         reqAuth = reqAuth,
+        reqUnlocked = reqUnlocked,
         strongBox = strongBox
       )
       AlgorithmType.RSA_4096_OAEP_SHA1 -> buildRSA(
@@ -360,12 +371,14 @@ class DeviceCryptoModule : Module() {
         padding = ENCRYPTION_PADDING_RSA_OAEP,
         keySize = 4096,
         reqAuth = reqAuth,
+        reqUnlocked = reqUnlocked,
         strongBox = strongBox
       )
       AlgorithmType.ECIES_P256_AES256_GCM -> buildECIES(
         alias = alias,
         digest = null,
         reqAuth = reqAuth,
+        reqUnlocked = reqUnlocked,
         strongBox = strongBox
       )
       AlgorithmType.RSA_SHA256 -> buildRSA(
@@ -375,6 +388,7 @@ class DeviceCryptoModule : Module() {
         padding = SIGNATURE_PADDING_RSA_PKCS1,
         keySize = 2048,
         reqAuth = reqAuth,
+        reqUnlocked = reqUnlocked,
         strongBox = strongBox
       )
       AlgorithmType.RSA_SHA256_PSS -> buildRSA(
@@ -384,6 +398,7 @@ class DeviceCryptoModule : Module() {
         padding = SIGNATURE_PADDING_RSA_PSS,
         keySize = 2048,
         reqAuth = reqAuth,
+        reqUnlocked = reqUnlocked,
         strongBox = strongBox
       )
       AlgorithmType.RSA_4096_SHA256 -> buildRSA(
@@ -393,6 +408,7 @@ class DeviceCryptoModule : Module() {
         padding = SIGNATURE_PADDING_RSA_PKCS1,
         keySize = 4096,
         reqAuth = reqAuth,
+        reqUnlocked = reqUnlocked,
         strongBox = strongBox
       )
       AlgorithmType.RSA_4096_SHA256_PSS -> buildRSA(
@@ -402,6 +418,7 @@ class DeviceCryptoModule : Module() {
         padding = SIGNATURE_PADDING_RSA_PSS,
         keySize = 4096,
         reqAuth = reqAuth,
+        reqUnlocked = reqUnlocked,
         strongBox = strongBox
       )
       else -> throw Exception("INVALID_ALGORITHM_TYPE")

package/build/DeviceCrypto.types.d.ts

@@ -64,6 +64,11 @@ export type GenerateKeyPairOptions = {
      * @platform android 🤖
      */
     preferStrongBox?: boolean;
+    /**
+     * Whether to require the device to be unlocked to use the key pair.
+     * @default true
+     */
+    requireUnlockedDevice?: boolean;
 };
 type BaseAuthOptions = {
     /**

package/build/DeviceCrypto.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceCrypto.types.d.ts","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,oBAAY,qBAAqB;IAC/B,kBAAkB,uBAAuB;IACzC,uBAAuB,4BAA4B;IACnD,aAAa,kBAAkB;CAChC;AAED,oBAAY,eAAe;IACzB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;CAC5B;AAED,oBAAY,UAAU;IACpB,QAAQ,aAAa;IACrB,qBAAqB,0BAA0B;CAChD;AAED,oBAAY,gBAAgB;IAC1B,sBAAsB,2BAA2B;IACjD,UAAU,eAAe;IACzB,cAAc,mBAAmB;IACjC,eAAe,oBAAoB;IACnC,mBAAmB,wBAAwB;CAC5C;AAED,oBAAY,mBAAmB;IAC7B,cAAc,mBAAmB;IACjC,kBAAkB,uBAAuB;IACzC,cAAc,mBAAmB;IACjC,kBAAkB,uBAAuB;IACzC,qBAAqB,0BAA0B;CAChD;AAED,KAAK,cAAc,GAAG,mBAAmB,CAAC,qBAAqB,CAAC;AAChE,KAAK,YAAY,GACb,mBAAmB,CAAC,cAAc,GAClC,mBAAmB,CAAC,kBAAkB,GACtC,mBAAmB,CAAC,cAAc,GAClC,mBAAmB,CAAC,kBAAkB,CAAC;AAE3C,MAAM,MAAM,sBAAsB,GAAG;IACnC;;OAEG;IACH,aAAa,EAAE,gBAAgB,GAAG,mBAAmB,CAAC;IACtD;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,KAAK,eAAe,GAAG;IACrB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB,CAAC;AAEF,KAAK,kBAAkB,GAAG;IACxB;;OAEG;IACH,aAAa,EAAE,gBAAgB,CAAC;CACjC,CAAC;AACF,KAAK,iBAAiB,GAAG,kBAAkB,CAAC;AAE5C,KAAK,wBAAwB,GAAG;IAC9B;;OAEG;IACH,aAAa,EAAE,YAAY,CAAC;CAC7B,CAAC;AACF,KAAK,wBAAwB,GAAG,wBAAwB,CAAC;AAEzD,KAAK,0BAA0B,GAAG;IAChC;;OAEG;IACH,aAAa,EAAE,cAAc,CAAC;IAC9B;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AACF,KAAK,0BAA0B,GAAG,0BAA0B,CAAC;AAE7D,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,kBAAkB,CAAC;AAC/D,MAAM,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAE9C,MAAM,MAAM,cAAc,GACtB,CAAC,eAAe,GAAG,0BAA0B,CAAC,GAC9C,CAAC,eAAe,GAAG,wBAAwB,CAAC,CAAC;AACjD,MAAM,MAAM,cAAc,GACtB,CAAC,eAAe,GAAG,0BAA0B,CAAC,GAC9C,wBAAwB,CAAC;AAE7B,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,MAAM,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;CAC3B"}
+{"version":3,"file":"DeviceCrypto.types.d.ts","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,oBAAY,qBAAqB;IAC/B,kBAAkB,uBAAuB;IACzC,uBAAuB,4BAA4B;IACnD,aAAa,kBAAkB;CAChC;AAED,oBAAY,eAAe;IACzB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;CAC5B;AAED,oBAAY,UAAU;IACpB,QAAQ,aAAa;IACrB,qBAAqB,0BAA0B;CAChD;AAED,oBAAY,gBAAgB;IAC1B,sBAAsB,2BAA2B;IACjD,UAAU,eAAe;IACzB,cAAc,mBAAmB;IACjC,eAAe,oBAAoB;IACnC,mBAAmB,wBAAwB;CAC5C;AAED,oBAAY,mBAAmB;IAC7B,cAAc,mBAAmB;IACjC,kBAAkB,uBAAuB;IACzC,cAAc,mBAAmB;IACjC,kBAAkB,uBAAuB;IACzC,qBAAqB,0BAA0B;CAChD;AAED,KAAK,cAAc,GAAG,mBAAmB,CAAC,qBAAqB,CAAC;AAChE,KAAK,YAAY,GACb,mBAAmB,CAAC,cAAc,GAClC,mBAAmB,CAAC,kBAAkB,GACtC,mBAAmB,CAAC,cAAc,GAClC,mBAAmB,CAAC,kBAAkB,CAAC;AAE3C,MAAM,MAAM,sBAAsB,GAAG;IACnC;;OAEG;IACH,aAAa,EAAE,gBAAgB,GAAG,mBAAmB,CAAC;IACtD;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC,CAAC;AAEF,KAAK,eAAe,GAAG;IACrB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB,CAAC;AAEF,KAAK,kBAAkB,GAAG;IACxB;;OAEG;IACH,aAAa,EAAE,gBAAgB,CAAC;CACjC,CAAC;AACF,KAAK,iBAAiB,GAAG,kBAAkB,CAAC;AAE5C,KAAK,wBAAwB,GAAG;IAC9B;;OAEG;IACH,aAAa,EAAE,YAAY,CAAC;CAC7B,CAAC;AACF,KAAK,wBAAwB,GAAG,wBAAwB,CAAC;AAEzD,KAAK,0BAA0B,GAAG;IAChC;;OAEG;IACH,aAAa,EAAE,cAAc,CAAC;IAC9B;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AACF,KAAK,0BAA0B,GAAG,0BAA0B,CAAC;AAE7D,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,kBAAkB,CAAC;AAC/D,MAAM,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAE9C,MAAM,MAAM,cAAc,GACtB,CAAC,eAAe,GAAG,0BAA0B,CAAC,GAC9C,CAAC,eAAe,GAAG,wBAAwB,CAAC,CAAC;AACjD,MAAM,MAAM,cAAc,GACtB,CAAC,eAAe,GAAG,0BAA0B,CAAC,GAC9C,wBAAwB,CAAC;AAE7B,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,MAAM,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;CAC3B"}

package/build/DeviceCrypto.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceCrypto.types.js","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,kEAAyC,CAAA;IACzC,4EAAmD,CAAA;IACnD,wDAA+B,CAAA;AACjC,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,0CAAuB,CAAA;IACvB,8CAA2B,CAAA;IAC3B,8CAA2B,CAAA;AAC7B,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAED,MAAM,CAAN,IAAY,UAGX;AAHD,WAAY,UAAU;IACpB,mCAAqB,CAAA;IACrB,6DAA+C,CAAA;AACjD,CAAC,EAHW,UAAU,KAAV,UAAU,QAGrB;AAED,MAAM,CAAN,IAAY,gBAMX;AAND,WAAY,gBAAgB;IAC1B,qEAAiD,CAAA;IACjD,6CAAyB,CAAA;IACzB,qDAAiC,CAAA;IACjC,uDAAmC,CAAA;IACnC,+DAA2C,CAAA;AAC7C,CAAC,EANW,gBAAgB,KAAhB,gBAAgB,QAM3B;AAED,MAAM,CAAN,IAAY,mBAMX;AAND,WAAY,mBAAmB;IAC7B,wDAAiC,CAAA;IACjC,gEAAyC,CAAA;IACzC,wDAAiC,CAAA;IACjC,gEAAyC,CAAA;IACzC,sEAA+C,CAAA;AACjD,CAAC,EANW,mBAAmB,KAAnB,mBAAmB,QAM9B","sourcesContent":["export enum GenerateKeyPairResult {\n  KEY_PAIR_GENERATED = \"KEY_PAIR_GENERATED\",\n  KEY_PAIR_ALREADY_EXISTS = \"KEY_PAIR_ALREADY_EXISTS\",\n  NOT_AVAILABLE = \"NOT_AVAILABLE\",\n}\n\nexport enum AuthCheckResult {\n  AVAILABLE = \"AVAILABLE\",\n  NO_HARDWARE = \"NO_HARDWARE\",\n  UNAVAILABLE = \"UNAVAILABLE\",\n}\n\nexport enum AuthMethod {\n  PASSCODE = \"PASSCODE\",\n  PASSCODE_OR_BIOMETRIC = \"PASSCODE_OR_BIOMETRIC\",\n}\n\nexport enum SigningAlgorithm {\n  ECDSA_SECP256R1_SHA256 = \"ECDSA_SECP256R1_SHA256\",\n  RSA_SHA256 = \"RSA_SHA256\",\n  RSA_SHA256_PSS = \"RSA_SHA256_PSS\",\n  RSA_4096_SHA256 = \"RSA_4096_SHA256\",\n  RSA_4096_SHA256_PSS = \"RSA_4096_SHA256_PSS\",\n}\n\nexport enum EncryptionAlgorithm {\n  RSA_2048_PKCS1 = \"RSA_2048_PKCS1\",\n  RSA_2048_OAEP_SHA1 = \"RSA_2048_OAEP_SHA1\",\n  RSA_4096_PKCS1 = \"RSA_4096_PKCS1\",\n  RSA_4096_OAEP_SHA1 = \"RSA_4096_OAEP_SHA1\",\n  ECIES_P256_AES256_GCM = \"ECIES_P256_AES256_GCM\",\n}\n\ntype EciesAlgorithm = EncryptionAlgorithm.ECIES_P256_AES256_GCM;\ntype RsaAlgorithm =\n  | EncryptionAlgorithm.RSA_2048_PKCS1\n  | EncryptionAlgorithm.RSA_2048_OAEP_SHA1\n  | EncryptionAlgorithm.RSA_4096_PKCS1\n  | EncryptionAlgorithm.RSA_4096_OAEP_SHA1;\n\nexport type GenerateKeyPairOptions = {\n  /**\n   * The algorithm type of the key to generate.\n   */\n  algorithmType: SigningAlgorithm | EncryptionAlgorithm;\n  /**\n   * Whether to require authentication to sign.\n   * Setting this to true will prompt biometric or passcode authentication before signing.\n   *\n   * Please check the *`isAuthCheckAvailable`* function to see if authentication is available.\n   * If authentication is not available, generating a key pair will throw an error.\n   * @default false\n   */\n  requireAuthentication?: boolean;\n  /**\n   * The method of authentication to use.\n   * Note that on Android you have to define it when signing or decrypting.\n   *\n   * If you want to allow to use Face ID, you need to add the following to your app.json config file:\n   * ```json\n   * \"ios\": {\n   *   \"infoPlist\": {\n   *     \"NSFaceIDUsageDescription\": \"We use Face ID to secure your data.\",\n   *   }\n   * }\n   * ```\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform ios 🍏\n   */\n  authMethod?: AuthMethod;\n  /**\n   * If the Strong Box is available, it will be used instead of the Trusted Execution Environment (TEE).\n   * @default false\n   * @platform android 🤖\n   */\n  preferStrongBox?: boolean;\n};\n\ntype BaseAuthOptions = {\n  /**\n   * The title of the prompt to show when authentication is required.\n   * @default \"Unlock\"\n   * @platform android 🤖\n   */\n  promptTitle?: string;\n  /**\n   * The subtitle of the prompt to show when authentication is required.\n   * @default \"Enter your PIN to continue\"\n   * @platform android 🤖\n   */\n  promptSubtitle?: string;\n  /**\n   * The method of authentication to use.\n   * Note that on iOS you have to define it when generating the key pair.\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform android 🤖\n   */\n  authMethod?: AuthMethod;\n};\n\ntype BaseSigningOptions = {\n  /**\n   * The algorithm type of the key to use for signing.\n   */\n  algorithmType: SigningAlgorithm;\n};\ntype BaseVerifyOptions = BaseSigningOptions;\n\ntype BaseRsaEncryptionOptions = {\n  /**\n   * The algorithm type of the key to use for encrypting.\n   */\n  algorithmType: RsaAlgorithm;\n};\ntype BaseRsaDecryptionOptions = BaseRsaEncryptionOptions;\n\ntype BaseEciesEncryptionOptions = {\n  /**\n   * The algorithm type of the key to use for encrypting.\n   */\n  algorithmType: EciesAlgorithm;\n  /**\n   * The peer public key to use for ECIES.\n   */\n  peerPublicKey: string;\n};\ntype BaseEciesDecryptionOptions = BaseEciesEncryptionOptions;\n\nexport type SignOptions = BaseAuthOptions & BaseSigningOptions;\nexport type VerifyOptions = BaseVerifyOptions;\n\nexport type DecryptOptions =\n  | (BaseAuthOptions & BaseEciesDecryptionOptions)\n  | (BaseAuthOptions & BaseRsaDecryptionOptions);\nexport type EncryptOptions =\n  | (BaseAuthOptions & BaseEciesEncryptionOptions)\n  | BaseRsaEncryptionOptions;\n\nexport interface GetPublicKeyOptions {\n  /**\n   * The format of the public key to return.\n   * @default \"PEM\" (Base64 of PEM-encoded SubjectPublicKeyInfo (SPKI) for P‑256)\n   */\n  format?: \"PEM\" | \"BASE64\";\n}\n"]}
+{"version":3,"file":"DeviceCrypto.types.js","sourceRoot":"","sources":["../src/DeviceCrypto.types.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,kEAAyC,CAAA;IACzC,4EAAmD,CAAA;IACnD,wDAA+B,CAAA;AACjC,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,0CAAuB,CAAA;IACvB,8CAA2B,CAAA;IAC3B,8CAA2B,CAAA;AAC7B,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAED,MAAM,CAAN,IAAY,UAGX;AAHD,WAAY,UAAU;IACpB,mCAAqB,CAAA;IACrB,6DAA+C,CAAA;AACjD,CAAC,EAHW,UAAU,KAAV,UAAU,QAGrB;AAED,MAAM,CAAN,IAAY,gBAMX;AAND,WAAY,gBAAgB;IAC1B,qEAAiD,CAAA;IACjD,6CAAyB,CAAA;IACzB,qDAAiC,CAAA;IACjC,uDAAmC,CAAA;IACnC,+DAA2C,CAAA;AAC7C,CAAC,EANW,gBAAgB,KAAhB,gBAAgB,QAM3B;AAED,MAAM,CAAN,IAAY,mBAMX;AAND,WAAY,mBAAmB;IAC7B,wDAAiC,CAAA;IACjC,gEAAyC,CAAA;IACzC,wDAAiC,CAAA;IACjC,gEAAyC,CAAA;IACzC,sEAA+C,CAAA;AACjD,CAAC,EANW,mBAAmB,KAAnB,mBAAmB,QAM9B","sourcesContent":["export enum GenerateKeyPairResult {\n  KEY_PAIR_GENERATED = \"KEY_PAIR_GENERATED\",\n  KEY_PAIR_ALREADY_EXISTS = \"KEY_PAIR_ALREADY_EXISTS\",\n  NOT_AVAILABLE = \"NOT_AVAILABLE\",\n}\n\nexport enum AuthCheckResult {\n  AVAILABLE = \"AVAILABLE\",\n  NO_HARDWARE = \"NO_HARDWARE\",\n  UNAVAILABLE = \"UNAVAILABLE\",\n}\n\nexport enum AuthMethod {\n  PASSCODE = \"PASSCODE\",\n  PASSCODE_OR_BIOMETRIC = \"PASSCODE_OR_BIOMETRIC\",\n}\n\nexport enum SigningAlgorithm {\n  ECDSA_SECP256R1_SHA256 = \"ECDSA_SECP256R1_SHA256\",\n  RSA_SHA256 = \"RSA_SHA256\",\n  RSA_SHA256_PSS = \"RSA_SHA256_PSS\",\n  RSA_4096_SHA256 = \"RSA_4096_SHA256\",\n  RSA_4096_SHA256_PSS = \"RSA_4096_SHA256_PSS\",\n}\n\nexport enum EncryptionAlgorithm {\n  RSA_2048_PKCS1 = \"RSA_2048_PKCS1\",\n  RSA_2048_OAEP_SHA1 = \"RSA_2048_OAEP_SHA1\",\n  RSA_4096_PKCS1 = \"RSA_4096_PKCS1\",\n  RSA_4096_OAEP_SHA1 = \"RSA_4096_OAEP_SHA1\",\n  ECIES_P256_AES256_GCM = \"ECIES_P256_AES256_GCM\",\n}\n\ntype EciesAlgorithm = EncryptionAlgorithm.ECIES_P256_AES256_GCM;\ntype RsaAlgorithm =\n  | EncryptionAlgorithm.RSA_2048_PKCS1\n  | EncryptionAlgorithm.RSA_2048_OAEP_SHA1\n  | EncryptionAlgorithm.RSA_4096_PKCS1\n  | EncryptionAlgorithm.RSA_4096_OAEP_SHA1;\n\nexport type GenerateKeyPairOptions = {\n  /**\n   * The algorithm type of the key to generate.\n   */\n  algorithmType: SigningAlgorithm | EncryptionAlgorithm;\n  /**\n   * Whether to require authentication to sign.\n   * Setting this to true will prompt biometric or passcode authentication before signing.\n   *\n   * Please check the *`isAuthCheckAvailable`* function to see if authentication is available.\n   * If authentication is not available, generating a key pair will throw an error.\n   * @default false\n   */\n  requireAuthentication?: boolean;\n  /**\n   * The method of authentication to use.\n   * Note that on Android you have to define it when signing or decrypting.\n   *\n   * If you want to allow to use Face ID, you need to add the following to your app.json config file:\n   * ```json\n   * \"ios\": {\n   *   \"infoPlist\": {\n   *     \"NSFaceIDUsageDescription\": \"We use Face ID to secure your data.\",\n   *   }\n   * }\n   * ```\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform ios 🍏\n   */\n  authMethod?: AuthMethod;\n  /**\n   * If the Strong Box is available, it will be used instead of the Trusted Execution Environment (TEE).\n   * @default false\n   * @platform android 🤖\n   */\n  preferStrongBox?: boolean;\n  /**\n   * Whether to require the device to be unlocked to use the key pair.\n   * @default true\n   */\n  requireUnlockedDevice?: boolean;\n};\n\ntype BaseAuthOptions = {\n  /**\n   * The title of the prompt to show when authentication is required.\n   * @default \"Unlock\"\n   * @platform android 🤖\n   */\n  promptTitle?: string;\n  /**\n   * The subtitle of the prompt to show when authentication is required.\n   * @default \"Enter your PIN to continue\"\n   * @platform android 🤖\n   */\n  promptSubtitle?: string;\n  /**\n   * The method of authentication to use.\n   * Note that on iOS you have to define it when generating the key pair.\n   * @default AuthMethod.PASSCODE_OR_BIOMETRIC\n   * @platform android 🤖\n   */\n  authMethod?: AuthMethod;\n};\n\ntype BaseSigningOptions = {\n  /**\n   * The algorithm type of the key to use for signing.\n   */\n  algorithmType: SigningAlgorithm;\n};\ntype BaseVerifyOptions = BaseSigningOptions;\n\ntype BaseRsaEncryptionOptions = {\n  /**\n   * The algorithm type of the key to use for encrypting.\n   */\n  algorithmType: RsaAlgorithm;\n};\ntype BaseRsaDecryptionOptions = BaseRsaEncryptionOptions;\n\ntype BaseEciesEncryptionOptions = {\n  /**\n   * The algorithm type of the key to use for encrypting.\n   */\n  algorithmType: EciesAlgorithm;\n  /**\n   * The peer public key to use for ECIES.\n   */\n  peerPublicKey: string;\n};\ntype BaseEciesDecryptionOptions = BaseEciesEncryptionOptions;\n\nexport type SignOptions = BaseAuthOptions & BaseSigningOptions;\nexport type VerifyOptions = BaseVerifyOptions;\n\nexport type DecryptOptions =\n  | (BaseAuthOptions & BaseEciesDecryptionOptions)\n  | (BaseAuthOptions & BaseRsaDecryptionOptions);\nexport type EncryptOptions =\n  | (BaseAuthOptions & BaseEciesEncryptionOptions)\n  | BaseRsaEncryptionOptions;\n\nexport interface GetPublicKeyOptions {\n  /**\n   * The format of the public key to return.\n   * @default \"PEM\" (Base64 of PEM-encoded SubjectPublicKeyInfo (SPKI) for P‑256)\n   */\n  format?: \"PEM\" | \"BASE64\";\n}\n"]}

package/build/DeviceCryptoModule.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceCryptoModule.d.ts","sourceRoot":"","sources":["../src/DeviceCryptoModule.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EAEnB,WAAW,EACX,cAAc,EACd,aAAa,EAEb,cAAc,EAEf,MAAM,sBAAsB,CAAC;;IA8B5B;;;OAGG;gCAvBqB,eAAe;IAyBvC;;;;OAIG;gCA5BqB,OAAO;IA8B/B;;;;OAIG;6BAC4B,MAAM,YAAY,sBAAsB;IASvE;;;;;OAKG;0BACmB,MAAM,YAAY,mBAAmB;IAW3D;;;;OAIG;2BA9DkB,MAAM,KAAG,OAAO;IAgErC;;;OAGG;mBAlEQ,MAAM,EAAE;IAoEnB;;;;;;OAMG;kBACiB,MAAM,QAAQ,MAAM,YAAY,WAAW;IAU/D;;;;;;;OAOG;oBAEM,MAAM,QACP,MAAM,aACD,MAAM,YACP,aAAa;IAQzB;;;;;;;;;OASG;qBACoB,MAAM,QAAQ,MAAM,YAAY,cAAc;IAcrE;;;;;;OAMG;qBACoB,MAAM,QAAQ,MAAM,YAAY,cAAc;;AA1HvE,wBAqIE"}
+{"version":3,"file":"DeviceCryptoModule.d.ts","sourceRoot":"","sources":["../src/DeviceCryptoModule.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EAEnB,WAAW,EACX,cAAc,EACd,aAAa,EAEb,cAAc,EAEf,MAAM,sBAAsB,CAAC;;IA8B5B;;;OAGG;gCAvBqB,eAAe;IAyBvC;;;;OAIG;gCA5BqB,OAAO;IA8B/B;;;;OAIG;6BAC4B,MAAM,YAAY,sBAAsB;IAUvE;;;;;OAKG;0BACmB,MAAM,YAAY,mBAAmB;IAW3D;;;;OAIG;2BA/DkB,MAAM,KAAG,OAAO;IAiErC;;;OAGG;mBAnEQ,MAAM,EAAE;IAqEnB;;;;;;OAMG;kBACiB,MAAM,QAAQ,MAAM,YAAY,WAAW;IAU/D;;;;;;;OAOG;oBAEM,MAAM,QACP,MAAM,aACD,MAAM,YACP,aAAa;IAQzB;;;;;;;;;OASG;qBACoB,MAAM,QAAQ,MAAM,YAAY,cAAc;IAcrE;;;;;;OAMG;qBACoB,MAAM,QAAQ,MAAM,YAAY,cAAc;;AA3HvE,wBAsIE"}

package/build/DeviceCryptoModule.js

@@ -29,6 +29,7 @@ export default {
             reqAuth: options?.requireAuthentication ?? false,
             authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,
             preferStrongBox: options?.preferStrongBox ?? false,
+            reqUnlocked: options?.requireUnlockedDevice ?? true,
         };
         return module.generateKeyPair(alias, o);
     },

package/build/DeviceCryptoModule.js.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceCryptoModule.js","sourceRoot":"","sources":["../src/DeviceCryptoModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAEzD,OAAO,EAKL,UAAU,EAIV,gBAAgB,EAEhB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAE9B,SAAS,WAAW,CAAC,MAAc,EAAE,KAAK,GAAG,MAAM;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAE/D,OAAO,cAAc,KAAK,UAAU,OAAO,cAAc,KAAK,SAAS,CAAC;AAC1E,CAAC;AAoBD,MAAM,MAAM,GAAG,mBAAmB,CAAqB,cAAc,CAAC,CAAC;AAEvE,eAAe;IACb;;;OAGG;IACH,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;IACjD;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;IACjD;;;;OAIG;IACH,eAAe,EAAE,KAAK,EAAE,KAAa,EAAE,OAAgC,EAAE,EAAE;QACzE,MAAM,CAAC,GAAG;YACR,QAAQ,EAAE,OAAO,EAAE,aAAa;YAChC,OAAO,EAAE,OAAO,EAAE,qBAAqB,IAAI,KAAK;YAChD,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,eAAe,EAAE,OAAO,EAAE,eAAe,IAAI,KAAK;SACnD,CAAC;QACF,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD;;;;;OAKG;IACH,YAAY,EAAE,CAAC,KAAa,EAAE,OAA6B,EAAE,EAAE;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,OAAO,EAAE,MAAM,KAAK,KAAK,EAAE,CAAC;YAC9B,OAAO,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,OAAO,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC9C,CAAC;IACD;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC,aAAa;IACnC;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC,OAAO;IACvB;;;;;;OAMG;IACH,IAAI,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAqB,EAAE,EAAE;QACjE,MAAM,CAAC,GAAG;YACR,KAAK,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ;YACvC,QAAQ,EAAE,OAAO,EAAE,cAAc,IAAI,4BAA4B;YACjE,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,QAAQ,EACN,OAAO,EAAE,aAAa,IAAI,gBAAgB,CAAC,sBAAsB;SACpE,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IACD;;;;;;;OAOG;IACH,MAAM,EAAE,KAAK,EACX,KAAa,EACb,IAAY,EACZ,SAAiB,EACjB,OAAuB,EACvB,EAAE;QACF,MAAM,CAAC,GAAG;YACR,QAAQ,EACN,OAAO,EAAE,aAAa,IAAI,gBAAgB,CAAC,sBAAsB;SACpE,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC;IACD;;;;;;;;;OASG;IACH,OAAO,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAwB,EAAE,EAAE;QACvE,MAAM,CAAC,GAAG;YACR,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,mBAAmB,CAAC,cAAc;YACtE,aAAa;YACb,KAAK,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ;YACvC,aAAa;YACb,QAAQ,EAAE,OAAO,EAAE,cAAc,IAAI,4BAA4B;YACjE,aAAa;YACb,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,aAAa;YACb,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,EAAE;SAC5C,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IACD;;;;;;OAMG;IACH,OAAO,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAwB,EAAE,EAAE;QACvE,MAAM,CAAC,GAAG;YACR,KAAK,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ;YACvC,QAAQ,EAAE,OAAO,EAAE,cAAc,IAAI,4BAA4B;YACjE,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,mBAAmB,CAAC,cAAc;YACtE,aAAa;YACb,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,EAAE;SAC5C,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;CACF,CAAC","sourcesContent":["import { NativeModule, requireNativeModule } from \"expo\";\n\nimport {\n  AuthCheckResult,\n  GenerateKeyPairOptions,\n  GenerateKeyPairResult,\n  GetPublicKeyOptions,\n  AuthMethod,\n  SignOptions,\n  DecryptOptions,\n  VerifyOptions,\n  SigningAlgorithm,\n  EncryptOptions,\n  EncryptionAlgorithm,\n} from \"./DeviceCrypto.types\";\n\nfunction base64ToPem(base64: string, label = \"DATA\") {\n  const normalized = base64.replace(/\\s+/g, \"\");\n  const wrapped = normalized.match(/.{1,64}/g)?.join(\"\\n\") ?? \"\";\n\n  return `-----BEGIN ${label}-----\\n${wrapped}\\n-----END ${label}-----\\n`;\n}\n\ndeclare class DeviceCryptoModule extends NativeModule {\n  isAuthCheckAvailable(): AuthCheckResult;\n  isStrongBoxAvailable(): boolean;\n  generateKeyPair(alias: string, o: any): GenerateKeyPairResult;\n  getPublicKey(alias: string): string | null;\n  removeKeyPair(alias: string): boolean;\n  aliases(): string[];\n  sign(alias: string, data: string, o: any): Promise<string | null>;\n  verify(\n    alias: string,\n    data: string,\n    signature: string,\n    o: any\n  ): boolean | null;\n  encrypt(alias: string, data: string, o: any): Promise<string | null>;\n  decrypt(alias: string, data: string, o: any): Promise<string | null>;\n}\n\nconst module = requireNativeModule<DeviceCryptoModule>(\"DeviceCrypto\");\n\nexport default {\n  /**\n   * Checks if the biometric or passcode authentication is available.\n   * @returns The result of the operation.\n   */\n  isAuthCheckAvailable: module.isAuthCheckAvailable,\n  /**\n   * Checks if the strong box is available .\n   * @returns The result of the operation.\n   * @platform android 🤖\n   */\n  isStrongBoxAvailable: module.isStrongBoxAvailable,\n  /**\n   * Creates a new ECDSA P‑256 key pair for the given alias, if it doesn’t already exist.\n   * @param alias - The alias to use for the key pair.\n   * @returns The result of the operation.\n   */\n  generateKeyPair: async (alias: string, options?: GenerateKeyPairOptions) => {\n    const o = {\n      algoType: options?.algorithmType,\n      reqAuth: options?.requireAuthentication ?? false,\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      preferStrongBox: options?.preferStrongBox ?? false,\n    };\n    return module.generateKeyPair(alias, o);\n  },\n  /**\n   * Returns the public key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param options - The options for the operation.\n   * @returns The public key.\n   */\n  getPublicKey: (alias: string, options?: GetPublicKeyOptions) => {\n    const publicKey = module.getPublicKey(alias);\n    if (!publicKey) return null;\n    if (options?.format === \"PEM\") {\n      return base64ToPem(publicKey, \"PUBLIC KEY\");\n    } else if (options?.format === \"BASE64\") {\n      return publicKey;\n    }\n\n    return base64ToPem(publicKey, \"PUBLIC KEY\");\n  },\n  /**\n   * Removes the key pair for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @returns True if the key pair was removed, false otherwise.\n   */\n  removeKeyPair: module.removeKeyPair,\n  /**\n   * Lists the aliases for the key pairs.\n   * @returns The aliases.\n   */\n  aliases: module.aliases,\n  /**\n   * Signs the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to sign.\n   * @param options - The options for the operation.\n   * @returns The signature.\n   */\n  sign: async (alias: string, data: string, options?: SignOptions) => {\n    const o = {\n      title: options?.promptTitle ?? \"Unlock\",\n      subtitle: options?.promptSubtitle ?? \"Enter your PIN to continue\",\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      algoType:\n        options?.algorithmType ?? SigningAlgorithm.ECDSA_SECP256R1_SHA256,\n    };\n    return module.sign(alias, data, o);\n  },\n  /**\n   * Verifies the given data with the signature for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to verify in UTF-8 format.\n   * @param signature - The signature to verify in Base64 format.\n   * @param options - The options for the operation.\n   * @returns True if the signature is valid, false otherwise.\n   */\n  verify: async (\n    alias: string,\n    data: string,\n    signature: string,\n    options?: VerifyOptions\n  ) => {\n    const o = {\n      algoType:\n        options?.algorithmType ?? SigningAlgorithm.ECDSA_SECP256R1_SHA256,\n    };\n    return module.verify(alias, data, signature, o);\n  },\n  /**\n   * Signs the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to sign in UTF-8 format.\n   * @param options - The options for the operation.\n   * @default {\n   *  algoType: EncryptionAlgorithm.RSA_2048_PKCS1,\n   * }\n   * @returns The signature.\n   */\n  encrypt: async (alias: string, data: string, options?: EncryptOptions) => {\n    const o = {\n      algoType: options?.algorithmType ?? EncryptionAlgorithm.RSA_2048_PKCS1,\n      // @ts-ignore\n      title: options?.promptTitle ?? \"Unlock\",\n      // @ts-ignore\n      subtitle: options?.promptSubtitle ?? \"Enter your PIN to continue\",\n      // @ts-ignore\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      // @ts-ignore\n      peerPublicKey: options?.peerPublicKey ?? \"\",\n    };\n    return module.encrypt(alias, data, o);\n  },\n  /**\n   * Decrypts the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to decrypt in Base64 format.\n   * @param options - The options for the operation.\n   * @returns The decrypted data.\n   */\n  decrypt: async (alias: string, data: string, options?: DecryptOptions) => {\n    const o = {\n      title: options?.promptTitle ?? \"Unlock\",\n      subtitle: options?.promptSubtitle ?? \"Enter your PIN to continue\",\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      algoType: options?.algorithmType ?? EncryptionAlgorithm.RSA_2048_PKCS1,\n      // @ts-ignore\n      peerPublicKey: options?.peerPublicKey ?? \"\",\n    };\n    return module.decrypt(alias, data, o);\n  },\n};\n"]}
+{"version":3,"file":"DeviceCryptoModule.js","sourceRoot":"","sources":["../src/DeviceCryptoModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAEzD,OAAO,EAKL,UAAU,EAIV,gBAAgB,EAEhB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAE9B,SAAS,WAAW,CAAC,MAAc,EAAE,KAAK,GAAG,MAAM;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAE/D,OAAO,cAAc,KAAK,UAAU,OAAO,cAAc,KAAK,SAAS,CAAC;AAC1E,CAAC;AAoBD,MAAM,MAAM,GAAG,mBAAmB,CAAqB,cAAc,CAAC,CAAC;AAEvE,eAAe;IACb;;;OAGG;IACH,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;IACjD;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;IACjD;;;;OAIG;IACH,eAAe,EAAE,KAAK,EAAE,KAAa,EAAE,OAAgC,EAAE,EAAE;QACzE,MAAM,CAAC,GAAG;YACR,QAAQ,EAAE,OAAO,EAAE,aAAa;YAChC,OAAO,EAAE,OAAO,EAAE,qBAAqB,IAAI,KAAK;YAChD,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,eAAe,EAAE,OAAO,EAAE,eAAe,IAAI,KAAK;YAClD,WAAW,EAAE,OAAO,EAAE,qBAAqB,IAAI,IAAI;SACpD,CAAC;QACF,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD;;;;;OAKG;IACH,YAAY,EAAE,CAAC,KAAa,EAAE,OAA6B,EAAE,EAAE;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,OAAO,EAAE,MAAM,KAAK,KAAK,EAAE,CAAC;YAC9B,OAAO,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,OAAO,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC9C,CAAC;IACD;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC,aAAa;IACnC;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC,OAAO;IACvB;;;;;;OAMG;IACH,IAAI,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAqB,EAAE,EAAE;QACjE,MAAM,CAAC,GAAG;YACR,KAAK,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ;YACvC,QAAQ,EAAE,OAAO,EAAE,cAAc,IAAI,4BAA4B;YACjE,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,QAAQ,EACN,OAAO,EAAE,aAAa,IAAI,gBAAgB,CAAC,sBAAsB;SACpE,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IACD;;;;;;;OAOG;IACH,MAAM,EAAE,KAAK,EACX,KAAa,EACb,IAAY,EACZ,SAAiB,EACjB,OAAuB,EACvB,EAAE;QACF,MAAM,CAAC,GAAG;YACR,QAAQ,EACN,OAAO,EAAE,aAAa,IAAI,gBAAgB,CAAC,sBAAsB;SACpE,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC;IACD;;;;;;;;;OASG;IACH,OAAO,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAwB,EAAE,EAAE;QACvE,MAAM,CAAC,GAAG;YACR,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,mBAAmB,CAAC,cAAc;YACtE,aAAa;YACb,KAAK,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ;YACvC,aAAa;YACb,QAAQ,EAAE,OAAO,EAAE,cAAc,IAAI,4BAA4B;YACjE,aAAa;YACb,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,aAAa;YACb,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,EAAE;SAC5C,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IACD;;;;;;OAMG;IACH,OAAO,EAAE,KAAK,EAAE,KAAa,EAAE,IAAY,EAAE,OAAwB,EAAE,EAAE;QACvE,MAAM,CAAC,GAAG;YACR,KAAK,EAAE,OAAO,EAAE,WAAW,IAAI,QAAQ;YACvC,QAAQ,EAAE,OAAO,EAAE,cAAc,IAAI,4BAA4B;YACjE,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,qBAAqB;YACnE,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,mBAAmB,CAAC,cAAc;YACtE,aAAa;YACb,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,EAAE;SAC5C,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;CACF,CAAC","sourcesContent":["import { NativeModule, requireNativeModule } from \"expo\";\n\nimport {\n  AuthCheckResult,\n  GenerateKeyPairOptions,\n  GenerateKeyPairResult,\n  GetPublicKeyOptions,\n  AuthMethod,\n  SignOptions,\n  DecryptOptions,\n  VerifyOptions,\n  SigningAlgorithm,\n  EncryptOptions,\n  EncryptionAlgorithm,\n} from \"./DeviceCrypto.types\";\n\nfunction base64ToPem(base64: string, label = \"DATA\") {\n  const normalized = base64.replace(/\\s+/g, \"\");\n  const wrapped = normalized.match(/.{1,64}/g)?.join(\"\\n\") ?? \"\";\n\n  return `-----BEGIN ${label}-----\\n${wrapped}\\n-----END ${label}-----\\n`;\n}\n\ndeclare class DeviceCryptoModule extends NativeModule {\n  isAuthCheckAvailable(): AuthCheckResult;\n  isStrongBoxAvailable(): boolean;\n  generateKeyPair(alias: string, o: any): GenerateKeyPairResult;\n  getPublicKey(alias: string): string | null;\n  removeKeyPair(alias: string): boolean;\n  aliases(): string[];\n  sign(alias: string, data: string, o: any): Promise<string | null>;\n  verify(\n    alias: string,\n    data: string,\n    signature: string,\n    o: any\n  ): boolean | null;\n  encrypt(alias: string, data: string, o: any): Promise<string | null>;\n  decrypt(alias: string, data: string, o: any): Promise<string | null>;\n}\n\nconst module = requireNativeModule<DeviceCryptoModule>(\"DeviceCrypto\");\n\nexport default {\n  /**\n   * Checks if the biometric or passcode authentication is available.\n   * @returns The result of the operation.\n   */\n  isAuthCheckAvailable: module.isAuthCheckAvailable,\n  /**\n   * Checks if the strong box is available .\n   * @returns The result of the operation.\n   * @platform android 🤖\n   */\n  isStrongBoxAvailable: module.isStrongBoxAvailable,\n  /**\n   * Creates a new ECDSA P‑256 key pair for the given alias, if it doesn’t already exist.\n   * @param alias - The alias to use for the key pair.\n   * @returns The result of the operation.\n   */\n  generateKeyPair: async (alias: string, options?: GenerateKeyPairOptions) => {\n    const o = {\n      algoType: options?.algorithmType,\n      reqAuth: options?.requireAuthentication ?? false,\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      preferStrongBox: options?.preferStrongBox ?? false,\n      reqUnlocked: options?.requireUnlockedDevice ?? true,\n    };\n    return module.generateKeyPair(alias, o);\n  },\n  /**\n   * Returns the public key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param options - The options for the operation.\n   * @returns The public key.\n   */\n  getPublicKey: (alias: string, options?: GetPublicKeyOptions) => {\n    const publicKey = module.getPublicKey(alias);\n    if (!publicKey) return null;\n    if (options?.format === \"PEM\") {\n      return base64ToPem(publicKey, \"PUBLIC KEY\");\n    } else if (options?.format === \"BASE64\") {\n      return publicKey;\n    }\n\n    return base64ToPem(publicKey, \"PUBLIC KEY\");\n  },\n  /**\n   * Removes the key pair for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @returns True if the key pair was removed, false otherwise.\n   */\n  removeKeyPair: module.removeKeyPair,\n  /**\n   * Lists the aliases for the key pairs.\n   * @returns The aliases.\n   */\n  aliases: module.aliases,\n  /**\n   * Signs the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to sign.\n   * @param options - The options for the operation.\n   * @returns The signature.\n   */\n  sign: async (alias: string, data: string, options?: SignOptions) => {\n    const o = {\n      title: options?.promptTitle ?? \"Unlock\",\n      subtitle: options?.promptSubtitle ?? \"Enter your PIN to continue\",\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      algoType:\n        options?.algorithmType ?? SigningAlgorithm.ECDSA_SECP256R1_SHA256,\n    };\n    return module.sign(alias, data, o);\n  },\n  /**\n   * Verifies the given data with the signature for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to verify in UTF-8 format.\n   * @param signature - The signature to verify in Base64 format.\n   * @param options - The options for the operation.\n   * @returns True if the signature is valid, false otherwise.\n   */\n  verify: async (\n    alias: string,\n    data: string,\n    signature: string,\n    options?: VerifyOptions\n  ) => {\n    const o = {\n      algoType:\n        options?.algorithmType ?? SigningAlgorithm.ECDSA_SECP256R1_SHA256,\n    };\n    return module.verify(alias, data, signature, o);\n  },\n  /**\n   * Signs the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to sign in UTF-8 format.\n   * @param options - The options for the operation.\n   * @default {\n   *  algoType: EncryptionAlgorithm.RSA_2048_PKCS1,\n   * }\n   * @returns The signature.\n   */\n  encrypt: async (alias: string, data: string, options?: EncryptOptions) => {\n    const o = {\n      algoType: options?.algorithmType ?? EncryptionAlgorithm.RSA_2048_PKCS1,\n      // @ts-ignore\n      title: options?.promptTitle ?? \"Unlock\",\n      // @ts-ignore\n      subtitle: options?.promptSubtitle ?? \"Enter your PIN to continue\",\n      // @ts-ignore\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      // @ts-ignore\n      peerPublicKey: options?.peerPublicKey ?? \"\",\n    };\n    return module.encrypt(alias, data, o);\n  },\n  /**\n   * Decrypts the given data with the private key for the given alias.\n   * @param alias - The alias to use for the key pair.\n   * @param data - The data to decrypt in Base64 format.\n   * @param options - The options for the operation.\n   * @returns The decrypted data.\n   */\n  decrypt: async (alias: string, data: string, options?: DecryptOptions) => {\n    const o = {\n      title: options?.promptTitle ?? \"Unlock\",\n      subtitle: options?.promptSubtitle ?? \"Enter your PIN to continue\",\n      authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,\n      algoType: options?.algorithmType ?? EncryptionAlgorithm.RSA_2048_PKCS1,\n      // @ts-ignore\n      peerPublicKey: options?.peerPublicKey ?? \"\",\n    };\n    return module.decrypt(alias, data, o);\n  },\n};\n"]}

package/ios/DeviceCrypto.podspec

@@ -1,6 +1,6 @@
 Pod::Spec.new do |s|
   s.name           = 'DeviceCrypto'
-  s.version        = '1.1.0'
+  s.version        = '1.2.0'
   s.summary        = 'Device crypto'
   s.description    = 'Device crypto for Expo using device hardware capabilities'
   s.author         = 'Piotr Pietras'

package/ios/DeviceCrypto.swift

@@ -80,7 +80,7 @@ public class DeviceCryptoModule: Module {
     return (item as! SecKey)
   }
 
-  private func buildECDSA(alias: String, reqAuth: Bool, authMethod: AuthMethod) -> SecKey? {
+  private func buildECDSA(alias: String, reqAuth: Bool, authMethod: AuthMethod, reqUnlocked: Bool) -> SecKey? {
     let accessFlags: SecAccessControlCreateFlags
     if reqAuth {
       switch authMethod {
@@ -93,9 +93,13 @@ public class DeviceCryptoModule: Module {
       accessFlags = .privateKeyUsage
     }
 
+    let lockPolicy = reqUnlocked
+      ? kSecAttrAccessibleWhenUnlockedThisDeviceOnly
+      : kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly;
+
     let access = SecAccessControlCreateWithFlags(
       kCFAllocatorDefault,
-      kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+      lockPolicy,
       accessFlags,
       nil
     ) 
@@ -118,7 +122,7 @@ public class DeviceCryptoModule: Module {
     return SecKeyCreateRandomKey(attributes, nil)
   }
 
-  private func buildRSA(alias: String, keySize: Int, reqAuth: Bool, authMethod: AuthMethod) -> SecKey? {
+  private func buildRSA(alias: String, keySize: Int, reqAuth: Bool, authMethod: AuthMethod, reqUnlocked: Bool) -> SecKey? {
     let accessFlags: SecAccessControlCreateFlags
     if reqAuth {
       switch authMethod {
@@ -131,9 +135,13 @@ public class DeviceCryptoModule: Module {
       accessFlags = []
     }
 
+    let lockPolicy = reqUnlocked
+      ? kSecAttrAccessibleWhenUnlockedThisDeviceOnly
+      : kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly;
+
     let access = SecAccessControlCreateWithFlags(
       kCFAllocatorDefault,
-      kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+      lockPolicy,
       accessFlags,
       nil
     ) 
@@ -155,7 +163,7 @@ public class DeviceCryptoModule: Module {
     return SecKeyCreateRandomKey(attributes, nil)
   }
 
-  private func buildECIES(alias: String, reqAuth: Bool, authMethod: AuthMethod) -> SecKey? {
+  private func buildECIES(alias: String, reqAuth: Bool, authMethod: AuthMethod, reqUnlocked: Bool) -> SecKey? {
     let accessFlags: SecAccessControlCreateFlags
     if reqAuth {
       switch authMethod {
@@ -168,9 +176,13 @@ public class DeviceCryptoModule: Module {
       accessFlags = .privateKeyUsage
     }
 
+    let lockPolicy = reqUnlocked
+      ? kSecAttrAccessibleWhenUnlockedThisDeviceOnly
+      : kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly;
+
     let access = SecAccessControlCreateWithFlags(
       kCFAllocatorDefault,
-      kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+      lockPolicy,
       accessFlags,
       nil
     )
@@ -237,6 +249,7 @@ public class DeviceCryptoModule: Module {
 
   private func generateKeyPair(alias: String, o: [String: Any]) throws -> String {
     let reqAuth = o["reqAuth"] as! Bool
+    let reqUnlocked = o["reqUnlocked"] as! Bool
     let authMethod = AuthMethod(rawValue: o["authMethod"] as! String)
     let algoType = AlgorithmType(rawValue: o["algoType"] as! String)
 
@@ -255,25 +268,25 @@ public class DeviceCryptoModule: Module {
 
     switch algoType {
       case .ECDSA_SECP256R1_SHA256:
-        self.buildECDSA(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
+        self.buildECDSA(alias: alias, reqAuth: reqAuth, authMethod: authMethod!, reqUnlocked: reqUnlocked)
       case .RSA_2048_PKCS1:
-        self.buildRSA(alias: alias, keySize: 2048, reqAuth: reqAuth, authMethod: authMethod!)
+        self.buildRSA(alias: alias, keySize: 2048, reqAuth: reqAuth, authMethod: authMethod!, reqUnlocked: reqUnlocked)
       case .RSA_2048_OAEP_SHA1:
-        self.buildRSA(alias: alias, keySize: 2048, reqAuth: reqAuth, authMethod: authMethod!)
+        self.buildRSA(alias: alias, keySize: 2048, reqAuth: reqAuth, authMethod: authMethod!, reqUnlocked: reqUnlocked)
       case .RSA_4096_PKCS1:
-        self.buildRSA(alias: alias, keySize: 4096, reqAuth: reqAuth, authMethod: authMethod!)
+        self.buildRSA(alias: alias, keySize: 4096, reqAuth: reqAuth, authMethod: authMethod!, reqUnlocked: reqUnlocked)
       case .RSA_4096_OAEP_SHA1:
-        self.buildRSA(alias: alias, keySize: 4096, reqAuth: reqAuth, authMethod: authMethod!)
+        self.buildRSA(alias: alias, keySize: 4096, reqAuth: reqAuth, authMethod: authMethod!, reqUnlocked: reqUnlocked)
       case .ECIES_P256_AES256_GCM:
-        self.buildECIES(alias: alias, reqAuth: reqAuth, authMethod: authMethod!)
+        self.buildECIES(alias: alias, reqAuth: reqAuth, authMethod: authMethod!, reqUnlocked: reqUnlocked)
       case .RSA_SHA256:
-        self.buildRSA(alias: alias, keySize: 2048, reqAuth: reqAuth, authMethod: authMethod!)
+        self.buildRSA(alias: alias, keySize: 2048, reqAuth: reqAuth, authMethod: authMethod!, reqUnlocked: reqUnlocked)
       case .RSA_SHA256_PSS:
-        self.buildRSA(alias: alias, keySize: 2048, reqAuth: reqAuth, authMethod: authMethod!)
+        self.buildRSA(alias: alias, keySize: 2048, reqAuth: reqAuth, authMethod: authMethod!, reqUnlocked: reqUnlocked)
       case .RSA_4096_SHA256:
-        self.buildRSA(alias: alias, keySize: 4096, reqAuth: reqAuth, authMethod: authMethod!)
+        self.buildRSA(alias: alias, keySize: 4096, reqAuth: reqAuth, authMethod: authMethod!, reqUnlocked: reqUnlocked)
       case .RSA_4096_SHA256_PSS:
-        self.buildRSA(alias: alias, keySize: 4096, reqAuth: reqAuth, authMethod: authMethod!)
+        self.buildRSA(alias: alias, keySize: 4096, reqAuth: reqAuth, authMethod: authMethod!, reqUnlocked: reqUnlocked)
       default:
         throw NSError(
           domain: "DeviceCrypto",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-device-crypto",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Crypto for Expo using device hardware capabilities",
   "main": "build/index.js",
   "types": "build/index.d.ts",
@@ -48,5 +48,10 @@
   },
   "peerDependencies": {
     "expo": "*"
+  },
+  "peerDependenciesMeta": {
+    "expo": {
+      "optional": true
+    }
   }
 }

package/src/DeviceCrypto.types.ts

@@ -74,6 +74,11 @@ export type GenerateKeyPairOptions = {
    * @platform android 🤖
    */
   preferStrongBox?: boolean;
+  /**
+   * Whether to require the device to be unlocked to use the key pair.
+   * @default true
+   */
+  requireUnlockedDevice?: boolean;
 };
 
 type BaseAuthOptions = {

package/src/DeviceCryptoModule.ts

@@ -64,6 +64,7 @@ export default {
       reqAuth: options?.requireAuthentication ?? false,
       authMethod: options?.authMethod ?? AuthMethod.PASSCODE_OR_BIOMETRIC,
       preferStrongBox: options?.preferStrongBox ?? false,
+      reqUnlocked: options?.requireUnlockedDevice ?? true,
     };
     return module.generateKeyPair(alias, o);
   },