ping-openmls-sdk-react-native-macos 0.3.0 → 0.6.0

package/ios/Generated.swift

@@ -814,11 +814,11 @@ open class MessagingClient:
         try! rustCall { uniffi_ping_ffi_fn_free_messagingclient(pointer, $0) }
     }
 
-    public static func `init`(identityExport: Data, deviceLabel: String, storage: Storage, transport: Transport, nowMs: UInt64, sqlitePath: String?, sqliteEncryptionKey: Data?) async throws -> MessagingClient {
+    public static func `init`(identityExport: Data, deviceLabel: String, storage: Storage, transport: Transport, nowMs: UInt64, sqlitePath: String?, sqliteEncryptionKey: Data?, deviceSigningSecretKey: Data?) async throws -> MessagingClient {
         return
             try await uniffiRustCallAsync(
                 rustFutureFunc: {
-                    uniffi_ping_ffi_fn_constructor_messagingclient_init(FfiConverterData.lower(identityExport), FfiConverterString.lower(deviceLabel), FfiConverterTypeStorage.lower(storage), FfiConverterTypeTransport.lower(transport), FfiConverterUInt64.lower(nowMs), FfiConverterOptionString.lower(sqlitePath), FfiConverterOptionData.lower(sqliteEncryptionKey))
+                    uniffi_ping_ffi_fn_constructor_messagingclient_init(FfiConverterData.lower(identityExport), FfiConverterString.lower(deviceLabel), FfiConverterTypeStorage.lower(storage), FfiConverterTypeTransport.lower(transport), FfiConverterUInt64.lower(nowMs), FfiConverterOptionString.lower(sqlitePath), FfiConverterOptionData.lower(sqliteEncryptionKey), FfiConverterOptionData.lower(deviceSigningSecretKey))
                 },
                 pollFunc: ffi_ping_ffi_rust_future_poll_pointer,
                 completeFunc: ffi_ping_ffi_rust_future_complete_pointer,
@@ -3610,7 +3610,7 @@ private var initializationResult: InitializationResult = {
     if uniffi_ping_ffi_checksum_method_transport_send() != 46493 {
         return InitializationResult.apiChecksumMismatch
     }
-    if uniffi_ping_ffi_checksum_constructor_messagingclient_init() != 34706 {
+    if uniffi_ping_ffi_checksum_constructor_messagingclient_init() != 35443 {
         return InitializationResult.apiChecksumMismatch
     }
 

package/ios/PingNativeModule.m

@@ -51,11 +51,15 @@ RCT_EXTERN_METHOD(generateIdentityExport: (RCTPromiseResolveBlock)resolve
 // Stage 4b: MessagingClient lifecycle.
 // [CR-4] sqlitePath + sqliteEncryptionKeyB64 are optional (nullable) — passing nil for
 // path falls back to the in-memory provider.
+// `deviceSigningSecretKeyB64` is the optional 32-byte Ed25519 secret the SDK adopts
+// as its device signing key on first init — used to align device_id with the host
+// auth layer's JWT claim. Pass nil to keep the random-key default.
 RCT_EXTERN_METHOD(initClient: (NSString *)identityB64
                   deviceLabel: (NSString *)deviceLabel
                   nowMs: (double)nowMs
                   sqlitePath: (NSString *)sqlitePath
                   sqliteEncryptionKeyB64: (NSString *)sqliteEncryptionKeyB64
+                  deviceSigningSecretKeyB64: (NSString *)deviceSigningSecretKeyB64
                   resolver: (RCTPromiseResolveBlock)resolve
                   rejecter: (RCTPromiseRejectBlock)reject)
 

package/ios/PingNativeModule.swift

@@ -211,13 +211,14 @@ public final class PingNative: RCTEventEmitter {
     /// `nowMs` is the wall-clock at the call site (Hermes can't pass UInt64 across the
     /// bridge precisely so we accept Double and truncate; valid for the next ~285,000
     /// years of Unix time).
-    @objc(initClient:deviceLabel:nowMs:sqlitePath:sqliteEncryptionKeyB64:resolver:rejecter:)
+    @objc(initClient:deviceLabel:nowMs:sqlitePath:sqliteEncryptionKeyB64:deviceSigningSecretKeyB64:resolver:rejecter:)
     public func initClient(
         _ identityB64: String,
         deviceLabel: String,
         nowMs: Double,
         sqlitePath: String?,
         sqliteEncryptionKeyB64: String?,
+        deviceSigningSecretKeyB64: String?,
         resolver resolve: @escaping RCTPromiseResolveBlock,
         rejecter reject: @escaping RCTPromiseRejectBlock
     ) {
@@ -238,6 +239,24 @@ public final class PingNative: RCTEventEmitter {
                     }
                     sqliteKey = keyData
                 }
+                // Optional Ed25519 device signing secret. Same 32-byte
+                // shape as the SQLCipher key; loud-reject on mismatched
+                // length so callers find the bug at init time rather
+                // than via a server-side `sender_device_mismatch`
+                // hours later.
+                var deviceSigningSecret: Data? = nil
+                if let secretB64 = deviceSigningSecretKeyB64,
+                   let secretData = Data(base64Encoded: secretB64) {
+                    guard secretData.count == 32 else {
+                        reject(
+                            "InvalidDeviceSigningKey",
+                            "deviceSigningSecretKey must be 32 bytes, got \(secretData.count)",
+                            nil
+                        )
+                        return
+                    }
+                    deviceSigningSecret = secretData
+                }
                 // UniFFI's `[Name=init]` constructor generates a static factory named
                 // `init` (backquoted because Swift reserves the bare identifier for
                 // designated initializers).
@@ -248,7 +267,8 @@ public final class PingNative: RCTEventEmitter {
                     transport: self.transportBridge,
                     nowMs: UInt64(nowMs),
                     sqlitePath: sqlitePath,
-                    sqliteEncryptionKey: sqliteKey
+                    sqliteEncryptionKey: sqliteKey,
+                    deviceSigningSecretKey: deviceSigningSecret
                 )
                 self.client = c
                 resolve(true)

package/ios/pingFFI.h

@@ -374,7 +374,7 @@ void uniffi_ping_ffi_fn_free_messagingclient(void*_Nonnull ptr, RustCallStatus *
 #endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_PING_FFI_FN_CONSTRUCTOR_MESSAGINGCLIENT_INIT
 #define UNIFFI_FFIDEF_UNIFFI_PING_FFI_FN_CONSTRUCTOR_MESSAGINGCLIENT_INIT
-uint64_t uniffi_ping_ffi_fn_constructor_messagingclient_init(RustBuffer identity_export, RustBuffer device_label, void*_Nonnull storage, void*_Nonnull transport, uint64_t now_ms, RustBuffer sqlite_path, RustBuffer sqlite_encryption_key
+uint64_t uniffi_ping_ffi_fn_constructor_messagingclient_init(RustBuffer identity_export, RustBuffer device_label, void*_Nonnull storage, void*_Nonnull transport, uint64_t now_ms, RustBuffer sqlite_path, RustBuffer sqlite_encryption_key, RustBuffer device_signing_secret_key
 );
 #endif
 #ifndef UNIFFI_FFIDEF_UNIFFI_PING_FFI_FN_METHOD_MESSAGINGCLIENT_ADD_MEMBERS

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ping-openmls-sdk-react-native-macos",
-  "version": "0.3.0",
+  "version": "0.6.0",
   "description": "Real MLS for React Native macOS apps — wraps the ping-openmls-sdk Rust core via UniFFI.",
   "homepage": "https://github.com/AMP-Media-Development/ping-openmls-sdk",
   "license": "Apache-2.0",

package/src/MessagingClient.ts

@@ -37,6 +37,25 @@ export interface ClientConfig {
    * from your OS keyring (Keychain on iOS, Keystore on Android, etc.).
    */
   sqliteEncryptionKey?: Uint8Array;
+  /**
+   * Optional 32-byte Ed25519 secret key the SDK adopts as its device
+   * signing key on FIRST init. When supplied, `deviceId()` returns
+   * `SHA-256(public_key_of(secret))` — deterministic from what the
+   * caller passes.
+   *
+   * Use case: align the SDK's `device_id` (which the SDK stamps into
+   * every envelope's `sender_device` field) with an externally-
+   * computed device id — typically `SHA-256(device_signing_pubkey)`
+   * in the host's auth layer, where the JWT carries that same value
+   * as its `device_id` claim. Without this alignment, a server that
+   * validates `envelope.sender_device == jwt.device_id` rejects every
+   * send with `sender_device_mismatch`.
+   *
+   * Ignored on re-init when a `LocalDevice` is already persisted in
+   * storage — the on-disk identity is authoritative for stability
+   * across restarts.
+   */
+  deviceSigningSecretKey?: Uint8Array;
 }
 
 /** [CR-2] One `(deviceId, keyPackage)` pair for `Conversation.addMembers`. */
@@ -85,12 +104,16 @@ export class MessagingClient {
       const sqliteKeyB64 = cfg.sqliteEncryptionKey
         ? bytesToBase64(cfg.sqliteEncryptionKey)
         : null;
+      const signingSecretB64 = cfg.deviceSigningSecretKey
+        ? bytesToBase64(cfg.deviceSigningSecretKey)
+        : null;
       await NativePing.initClient(
         identityB64,
         cfg.deviceLabel,
         Date.now(),
         cfg.sqlitePath ?? null,
         sqliteKeyB64,
+        signingSecretB64,
       );
     } catch (e) {
       // Init failed — disconnect the bridges so we don't leak event listeners.

package/src/NativePing.ts

@@ -59,6 +59,10 @@ export interface Spec extends TurboModule {
    *   (fine for tests / non-cold-start flows; **not** fine for NSE-style wake-ups).
    * - [CR-4] `sqliteEncryptionKeyB64` — 32-byte SQLCipher key, base64-encoded. Ignored
    *   when `sqlitePath` is `null`. Pass `null` if you don't want at-rest encryption.
+   * - `deviceSigningSecretKeyB64` — optional 32-byte Ed25519 secret the SDK
+   *   adopts as its device signing key on FIRST init. Pass `null` to keep
+   *   the legacy random-key behaviour. See `ClientConfig.deviceSigningSecretKey`
+   *   in MessagingClient.ts for the security rationale.
    *
    * Resolves to `true` on success, rejects with `InitFailed` (Rust error) or
    * `InvalidIdentity` (base64 decode) on failure.
@@ -69,6 +73,7 @@ export interface Spec extends TurboModule {
     nowMs: number,
     sqlitePath: string | null,
     sqliteEncryptionKeyB64: string | null,
+    deviceSigningSecretKeyB64: string | null,
   ): Promise<boolean>;
 
   /** Returns the active client's user_id as a hex string. Rejects if not initialised. */