react-native-nitro-passkeys 0.1.0

package/android/src/main/java/com/margelo/nitro/nitropasskeys/HybridNitroPasskeys.kt

@@ -0,0 +1,65 @@
+package com.margelo.nitro.nitropasskeys
+
+import android.os.Build
+import androidx.credentials.CreatePublicKeyCredentialRequest
+import androidx.credentials.CreatePublicKeyCredentialResponse
+import androidx.credentials.CredentialManager
+import androidx.credentials.GetCredentialRequest
+import androidx.credentials.GetPublicKeyCredentialOption
+import androidx.credentials.PublicKeyCredential
+import com.margelo.nitro.NitroModules
+import com.margelo.nitro.core.Promise
+import java.util.concurrent.atomic.AtomicBoolean
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+
+class HybridNitroPasskeys : HybridNitroPasskeysSpec() {
+  override val isSupported: Boolean
+    get() = Build.VERSION.SDK_INT >= 28
+
+  private val inFlight = AtomicBoolean(false)
+  private val mainScope = CoroutineScope(SupervisorJob() + Dispatchers.Main)
+
+  override fun create(creationOptionsJson: String): Promise<String> = runExclusive {
+    val activity = requireActivity()
+    // Constructed here because it can throw IllegalArgumentException.
+    val request = CreatePublicKeyCredentialRequest(requestJson = creationOptionsJson)
+    val response = CredentialManager.create(activity).createCredential(activity, request)
+    (response as? CreatePublicKeyCredentialResponse)?.registrationResponseJson
+        ?: throw Error("[Passkeys:unknown] Unexpected response type")
+  }
+
+  override fun get(requestOptionsJson: String): Promise<String> = runExclusive {
+    val activity = requireActivity()
+    val request =
+        GetCredentialRequest(listOf(GetPublicKeyCredentialOption(requestJson = requestOptionsJson)))
+    val result = CredentialManager.create(activity).getCredential(activity, request)
+    (result.credential as? PublicKeyCredential)?.authenticationResponseJson
+        ?: throw Error("[Passkeys:unknown] Unexpected credential type")
+  }
+
+  private fun requireActivity() =
+      NitroModules.applicationContext?.currentActivity
+          ?: throw Error("[Passkeys:unknown] No current Activity")
+
+  /**
+   * Runs [block] on the main scope with a single-flight guard. The guard is released on every path
+   * (success, any throw, cancellation). Errors are rethrown with a `[Passkeys:<token>]` prefix.
+   */
+  private fun runExclusive(block: suspend () -> String): Promise<String> {
+    if (!inFlight.compareAndSet(false, true)) {
+      return Promise.rejected(Error("[Passkeys:unknown] A passkey request is already in progress"))
+    }
+    return Promise.async(mainScope) {
+      try {
+        block()
+      } catch (e: Throwable) {
+        if (e.message?.contains("[Passkeys:") == true) throw e
+        throw Error(PasskeyErrorToken.message(e))
+      } finally {
+        inFlight.set(false)
+      }
+    }
+  }
+}

package/android/src/main/java/com/margelo/nitro/nitropasskeys/NitroPasskeysPackage.kt

@@ -0,0 +1,20 @@
+package com.margelo.nitro.nitropasskeys
+
+import com.facebook.react.BaseReactPackage
+import com.facebook.react.bridge.NativeModule
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.module.model.ReactModuleInfoProvider
+
+public class NitroPasskeysPackage : BaseReactPackage() {
+  override fun getModule(name: String, reactContext: ReactApplicationContext): NativeModule? = null
+
+  override fun getReactModuleInfoProvider(): ReactModuleInfoProvider = ReactModuleInfoProvider {
+    emptyMap()
+  }
+
+  companion object {
+    init {
+      NitroPasskeysOnLoad.initializeNative()
+    }
+  }
+}

package/android/src/main/java/com/margelo/nitro/nitropasskeys/PasskeyErrorToken.kt

@@ -0,0 +1,64 @@
+package com.margelo.nitro.nitropasskeys
+
+import androidx.credentials.exceptions.CreateCredentialCancellationException
+import androidx.credentials.exceptions.CreateCredentialNoCreateOptionException
+import androidx.credentials.exceptions.CreateCredentialProviderConfigurationException
+import androidx.credentials.exceptions.CreateCredentialUnsupportedException
+import androidx.credentials.exceptions.GetCredentialCancellationException
+import androidx.credentials.exceptions.GetCredentialProviderConfigurationException
+import androidx.credentials.exceptions.GetCredentialUnsupportedException
+import androidx.credentials.exceptions.NoCredentialException
+import androidx.credentials.exceptions.domerrors.AbortError
+import androidx.credentials.exceptions.domerrors.DataError
+import androidx.credentials.exceptions.domerrors.DomError
+import androidx.credentials.exceptions.domerrors.EncodingError
+import androidx.credentials.exceptions.domerrors.InvalidStateError
+import androidx.credentials.exceptions.domerrors.NotAllowedError
+import androidx.credentials.exceptions.domerrors.NotSupportedError
+import androidx.credentials.exceptions.domerrors.SecurityError
+import androidx.credentials.exceptions.domerrors.SyntaxError
+import androidx.credentials.exceptions.domerrors.TimeoutError
+import androidx.credentials.exceptions.publickeycredential.CreatePublicKeyCredentialDomException
+import androidx.credentials.exceptions.publickeycredential.GetPublicKeyCredentialDomException
+import org.json.JSONException
+
+/** Maps Credential Manager failures to the `[Passkeys:<token>]` tokens the JS layer parses. */
+object PasskeyErrorToken {
+  fun token(error: Throwable): String =
+      when (error) {
+        // DOM exceptions first: InvalidStateError means different things on create and on get.
+        is CreatePublicKeyCredentialDomException ->
+            if (error.domError is InvalidStateError) "alreadyRegistered"
+            else domToken(error.domError)
+        is GetPublicKeyCredentialDomException ->
+            if (error.domError is InvalidStateError) "unknown" else domToken(error.domError)
+        is GetCredentialCancellationException,
+        is CreateCredentialCancellationException -> "canceled"
+        is NoCredentialException -> "noCredentials"
+        is CreateCredentialProviderConfigurationException,
+        is GetCredentialProviderConfigurationException,
+        is CreateCredentialNoCreateOptionException,
+        is CreateCredentialUnsupportedException,
+        is GetCredentialUnsupportedException -> "unsupported"
+        // JSONException is defensive: the request constructors document IllegalArgumentException.
+        is IllegalArgumentException,
+        is JSONException -> "invalidOptions"
+        else -> "unknown"
+      }
+
+  private fun domToken(d: DomError): String =
+      when (d) {
+        is NotAllowedError,
+        is AbortError,
+        is TimeoutError -> "canceled"
+        is SecurityError -> "domainNotAssociated"
+        is NotSupportedError -> "unsupported"
+        is DataError,
+        is EncodingError,
+        is SyntaxError -> "invalidOptions"
+        else -> "unknown"
+      }
+
+  fun message(error: Throwable): String =
+      "[Passkeys:${token(error)}] ${error.message ?: error.javaClass.simpleName}"
+}

package/android/src/test/java/com/margelo/nitro/nitropasskeys/PasskeyErrorTokenTest.kt

@@ -0,0 +1,128 @@
+package com.margelo.nitro.nitropasskeys
+
+import androidx.credentials.exceptions.CreateCredentialCancellationException
+import androidx.credentials.exceptions.CreateCredentialInterruptedException
+import androidx.credentials.exceptions.CreateCredentialNoCreateOptionException
+import androidx.credentials.exceptions.CreateCredentialProviderConfigurationException
+import androidx.credentials.exceptions.CreateCredentialUnknownException
+import androidx.credentials.exceptions.CreateCredentialUnsupportedException
+import androidx.credentials.exceptions.GetCredentialCancellationException
+import androidx.credentials.exceptions.GetCredentialInterruptedException
+import androidx.credentials.exceptions.GetCredentialProviderConfigurationException
+import androidx.credentials.exceptions.GetCredentialUnknownException
+import androidx.credentials.exceptions.GetCredentialUnsupportedException
+import androidx.credentials.exceptions.NoCredentialException
+import androidx.credentials.exceptions.domerrors.AbortError
+import androidx.credentials.exceptions.domerrors.DataError
+import androidx.credentials.exceptions.domerrors.DomError
+import androidx.credentials.exceptions.domerrors.EncodingError
+import androidx.credentials.exceptions.domerrors.InvalidStateError
+import androidx.credentials.exceptions.domerrors.NetworkError
+import androidx.credentials.exceptions.domerrors.NotAllowedError
+import androidx.credentials.exceptions.domerrors.NotSupportedError
+import androidx.credentials.exceptions.domerrors.SecurityError
+import androidx.credentials.exceptions.domerrors.SyntaxError
+import androidx.credentials.exceptions.domerrors.TimeoutError
+import androidx.credentials.exceptions.publickeycredential.CreatePublicKeyCredentialDomException
+import androidx.credentials.exceptions.publickeycredential.GetPublicKeyCredentialDomException
+import org.json.JSONException
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class PasskeyErrorTokenTest {
+  private fun create(d: DomError) = CreatePublicKeyCredentialDomException(d, "x")
+
+  private fun get(d: DomError) = GetPublicKeyCredentialDomException(d, "x")
+
+  private fun assertBoth(expected: String, d: () -> DomError) {
+    assertEquals(expected, PasskeyErrorToken.token(create(d())))
+    assertEquals(expected, PasskeyErrorToken.token(get(d())))
+  }
+
+  @Test
+  fun invalidStateIsAlreadyRegisteredOnCreate() {
+    assertEquals("alreadyRegistered", PasskeyErrorToken.token(create(InvalidStateError())))
+  }
+
+  @Test
+  fun invalidStateIsUnknownOnGet() {
+    assertEquals("unknown", PasskeyErrorToken.token(get(InvalidStateError())))
+  }
+
+  @Test fun notAllowedIsCanceled() = assertBoth("canceled") { NotAllowedError() }
+
+  @Test fun abortIsCanceled() = assertBoth("canceled") { AbortError() }
+
+  @Test fun timeoutIsCanceled() = assertBoth("canceled") { TimeoutError() }
+
+  @Test fun securityIsDomainNotAssociated() = assertBoth("domainNotAssociated") { SecurityError() }
+
+  @Test fun notSupportedIsUnsupported() = assertBoth("unsupported") { NotSupportedError() }
+
+  @Test fun dataIsInvalidOptions() = assertBoth("invalidOptions") { DataError() }
+
+  @Test fun encodingIsInvalidOptions() = assertBoth("invalidOptions") { EncodingError() }
+
+  @Test fun syntaxIsInvalidOptions() = assertBoth("invalidOptions") { SyntaxError() }
+
+  @Test fun otherDomErrorIsUnknown() = assertBoth("unknown") { NetworkError() }
+
+  @Test
+  fun cancellationsAreCanceled() {
+    assertEquals("canceled", PasskeyErrorToken.token(GetCredentialCancellationException("x")))
+    assertEquals("canceled", PasskeyErrorToken.token(CreateCredentialCancellationException("x")))
+  }
+
+  @Test
+  fun noCredentialIsNoCredentials() {
+    assertEquals("noCredentials", PasskeyErrorToken.token(NoCredentialException("x")))
+  }
+
+  @Test
+  fun unsupportedClasses() {
+    val errors =
+        listOf(
+            CreateCredentialProviderConfigurationException("x"),
+            GetCredentialProviderConfigurationException("x"),
+            CreateCredentialNoCreateOptionException("x"),
+            CreateCredentialUnsupportedException("x"),
+            GetCredentialUnsupportedException("x"),
+        )
+    for (e in errors) assertEquals(
+        e.javaClass.simpleName,
+        "unsupported",
+        PasskeyErrorToken.token(e),
+    )
+  }
+
+  @Test
+  fun invalidOptionsExceptions() {
+    assertEquals("invalidOptions", PasskeyErrorToken.token(IllegalArgumentException("x")))
+    assertEquals("invalidOptions", PasskeyErrorToken.token(JSONException("x")))
+  }
+
+  @Test
+  fun unknownFallbacks() {
+    val errors =
+        listOf(
+            CreateCredentialInterruptedException("x"),
+            GetCredentialInterruptedException("x"),
+            CreateCredentialUnknownException("x"),
+            GetCredentialUnknownException("x"),
+            RuntimeException("x"),
+        )
+    for (e in errors) assertEquals(e.javaClass.simpleName, "unknown", PasskeyErrorToken.token(e))
+  }
+
+  @Test
+  fun messageFormat() {
+    assertEquals(
+        "[Passkeys:canceled] boom",
+        PasskeyErrorToken.message(GetCredentialCancellationException("boom")),
+    )
+    assertEquals(
+        "[Passkeys:unknown] RuntimeException",
+        PasskeyErrorToken.message(RuntimeException()),
+    )
+  }
+}

package/ios/Base64URL.swift

@@ -0,0 +1,37 @@
+import Foundation
+
+/// Unpadded base64url (RFC 4648 §5), the encoding WebAuthn JSON uses for every binary field.
+enum Base64URL {
+  private static let alphabet = Set(
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_="
+  )
+
+  /// Encodes `data` as base64url with `+`→`-`, `/`→`_` and no `=` padding.
+  static func encode(_ data: Data) -> String {
+    data.base64EncodedString()
+      .replacingOccurrences(of: "+", with: "-")
+      .replacingOccurrences(of: "/", with: "_")
+      .replacingOccurrences(of: "=", with: "")
+  }
+
+  /// Decodes padded or unpadded base64url. Returns `nil` for empty input, any character outside the
+  /// base64url alphabet (including `+`, `/` and whitespace) or an impossible length.
+  static func decode(_ string: String) -> Data? {
+    guard !string.isEmpty, string.allSatisfy({ alphabet.contains($0) }) else { return nil }
+
+    var unpadded = Substring(string)
+    while unpadded.last == "=" {
+      unpadded = unpadded.dropLast()
+    }
+    guard unpadded.count % 4 != 1 else { return nil }
+
+    var base64 = unpadded
+      .replacingOccurrences(of: "-", with: "+")
+      .replacingOccurrences(of: "_", with: "/")
+    let remainder = base64.count % 4
+    if remainder != 0 {
+      base64 += String(repeating: "=", count: 4 - remainder)
+    }
+    return Data(base64Encoded: base64)
+  }
+}

package/ios/Bridge.h

@@ -0,0 +1 @@
+#pragma once

package/ios/HybridNitroPasskeys.swift

@@ -0,0 +1,290 @@
+import AuthenticationServices
+import Foundation
+import NitroModules
+import UIKit
+
+/// WebAuthn passkeys on top of AuthenticationServices' platform provider.
+///
+/// `active` is only read or written under `lock`. That is what makes the `@unchecked Sendable`
+/// sound: JS calls arrive on the JS thread, settlement happens on the main thread.
+final class HybridNitroPasskeys: HybridNitroPasskeysSpec, @unchecked Sendable {
+  private let lock = NSLock()
+  /// The in-flight request. Also the strong reference that keeps the helper alive, because
+  /// `ASAuthorizationController` only holds its delegate weakly.
+  private var active: PasskeyRequest?
+
+  var isSupported: Bool { true }
+
+  func create(creationOptionsJson: String) throws -> Promise<String> {
+    begin { .registration(try RegistrationParameters(json: creationOptionsJson)) }
+  }
+
+  func get(requestOptionsJson: String) throws -> Promise<String> {
+    begin { .assertion(try AssertionParameters(json: requestOptionsJson)) }
+  }
+
+  private func begin(_ parse: () throws -> PasskeyCeremony) -> Promise<String> {
+    lock.lock()
+    defer { lock.unlock() }
+
+    guard active == nil else {
+      return .rejected(withError: passkeyError("unknown", "A passkey request is already in progress"))
+    }
+
+    let ceremony: PasskeyCeremony
+    do {
+      ceremony = try parse()
+    } catch {
+      return .rejected(withError: error)
+    }
+
+    let promise = Promise<String>()
+    let request = PasskeyRequest(ceremony: ceremony, promise: promise) { [weak self] settled in
+      self?.clear(settled)
+    }
+    active = request
+    DispatchQueue.main.async {
+      request.start()
+    }
+    return promise
+  }
+
+  /// Called exactly once per request, by `PasskeyRequest.settle`, before the promise settles so a
+  /// follow-up call made from the JS continuation is not rejected as "in progress".
+  private func clear(_ request: PasskeyRequest) {
+    lock.lock()
+    defer { lock.unlock() }
+    if active === request {
+      active = nil
+    }
+  }
+}
+
+// MARK: - Request helper
+
+enum PasskeyCeremony: Sendable {
+  case registration(RegistrationParameters)
+  case assertion(AssertionParameters)
+}
+
+private func passkeyError(_ token: String, _ text: String) -> Error {
+  RuntimeError.error(withMessage: PasskeyErrorToken.message(token: token, text))
+}
+
+/// One `create` or `get` ceremony. Lives on the main actor (both AuthenticationServices
+/// protocols are UI-actor isolated); only `init` runs on the calling JS thread.
+@MainActor
+private final class PasskeyRequest: NSObject {
+  private let ceremony: PasskeyCeremony
+  private let promise: Promise<String>
+  private let onSettle: @Sendable (PasskeyRequest) -> Void
+  private var anchor: ASPresentationAnchor?
+  private var controller: ASAuthorizationController?
+  private var settled = false
+
+  nonisolated init(
+    ceremony: PasskeyCeremony,
+    promise: Promise<String>,
+    onSettle: @escaping @Sendable (PasskeyRequest) -> Void
+  ) {
+    self.ceremony = ceremony
+    self.promise = promise
+    self.onSettle = onSettle
+    super.init()
+  }
+
+  func start() {
+    guard let window = Self.presentationWindow() else {
+      settle(.failure(passkeyError("unknown", "No window to present on")))
+      return
+    }
+    anchor = window
+
+    let request: ASAuthorizationRequest
+    switch ceremony {
+    case .registration(let parameters):
+      request = Self.registrationRequest(parameters)
+    case .assertion(let parameters):
+      request = Self.assertionRequest(parameters)
+    }
+
+    let controller = ASAuthorizationController(authorizationRequests: [request])
+    controller.delegate = self
+    controller.presentationContextProvider = self
+    self.controller = controller
+    controller.performRequests()
+  }
+}
+
+// MARK: ASAuthorizationControllerDelegate
+
+extension PasskeyRequest: ASAuthorizationControllerDelegate {
+  func authorizationController(
+    controller: ASAuthorizationController,
+    didCompleteWithAuthorization authorization: ASAuthorization
+  ) {
+    settle(Result { try responseJSON(for: authorization.credential) })
+  }
+
+  func authorizationController(controller: ASAuthorizationController, didCompleteWithError error: Error) {
+    let token = PasskeyErrorToken.token(for: error)
+    settle(.failure(passkeyError(token, error.localizedDescription)))
+  }
+}
+
+// MARK: ASAuthorizationControllerPresentationContextProviding
+
+extension PasskeyRequest: ASAuthorizationControllerPresentationContextProviding {
+  func presentationAnchor(for controller: ASAuthorizationController) -> ASPresentationAnchor {
+    // `start` sets the anchor before `performRequests`, so the fallback is never expected.
+    anchor ?? ASPresentationAnchor()
+  }
+}
+
+// MARK: Settlement, requests and responses
+
+extension PasskeyRequest {
+  /// Resolves or rejects the promise at most once and releases the in-flight slot.
+  private func settle(_ result: Result<String, Error>) {
+    guard !settled else { return }
+    settled = true
+
+    // Release the controller after the current delegate callback has returned, not while the
+    // controller is still on the stack calling us.
+    if let controller {
+      controller.delegate = nil
+      controller.presentationContextProvider = nil
+      DispatchQueue.main.async {
+        withExtendedLifetime(controller) {}
+      }
+    }
+    controller = nil
+    anchor = nil
+
+    onSettle(self)
+
+    switch result {
+    case .success(let json):
+      promise.resolve(withResult: json)
+    case .failure(let error):
+      promise.reject(withError: error)
+    }
+  }
+
+  // MARK: Building requests
+
+  private static func registrationRequest(
+    _ parameters: RegistrationParameters
+  ) -> ASAuthorizationPlatformPublicKeyCredentialRegistrationRequest {
+    let provider = ASAuthorizationPlatformPublicKeyCredentialProvider(relyingPartyIdentifier: parameters.rpID)
+    let request = provider.createCredentialRegistrationRequest(
+      challenge: parameters.challenge,
+      name: parameters.userName,
+      userID: parameters.userID
+    )
+    if let displayName = parameters.displayName, !displayName.isEmpty {
+      request.displayName = displayName
+    }
+    if let userVerification = parameters.userVerification {
+      request.userVerificationPreference = .init(rawValue: userVerification)
+    }
+    request.attestationPreference = .init(rawValue: parameters.attestation)
+    if !parameters.excludedCredentialIDs.isEmpty, #available(iOS 17.4, *) {
+      request.excludedCredentials = parameters.excludedCredentialIDs.map {
+        ASAuthorizationPlatformPublicKeyCredentialDescriptor(credentialID: $0)
+      }
+    }
+    return request
+  }
+
+  private static func assertionRequest(
+    _ parameters: AssertionParameters
+  ) -> ASAuthorizationPlatformPublicKeyCredentialAssertionRequest {
+    let provider = ASAuthorizationPlatformPublicKeyCredentialProvider(relyingPartyIdentifier: parameters.rpID)
+    let request = provider.createCredentialAssertionRequest(challenge: parameters.challenge)
+    if !parameters.allowedCredentialIDs.isEmpty {
+      request.allowedCredentials = parameters.allowedCredentialIDs.map {
+        ASAuthorizationPlatformPublicKeyCredentialDescriptor(credentialID: $0)
+      }
+    }
+    if let userVerification = parameters.userVerification {
+      request.userVerificationPreference = .init(rawValue: userVerification)
+    }
+    return request
+  }
+
+  // MARK: Building responses
+
+  private func responseJSON(for credential: ASAuthorizationCredential) throws -> String {
+    switch ceremony {
+    case .registration:
+      guard let registration = credential as? ASAuthorizationPlatformPublicKeyCredentialRegistration else {
+        throw passkeyError("unknown", "Unexpected credential type")
+      }
+      guard let attestationObject = registration.rawAttestationObject, !attestationObject.isEmpty else {
+        throw passkeyError("unknown", "Missing attestation object")
+      }
+      var attachment = "platform"
+      if #available(iOS 16.6, *) {
+        attachment = Self.attachmentName(registration.attachment)
+      }
+      return try PasskeyJSON.encode(
+        PasskeyJSON.RegistrationResponse(
+          credentialID: registration.credentialID,
+          clientDataJSON: registration.rawClientDataJSON,
+          attestationObject: attestationObject,
+          attachment: attachment
+        )
+      )
+
+    case .assertion:
+      guard let assertion = credential as? ASAuthorizationPlatformPublicKeyCredentialAssertion else {
+        throw passkeyError("unknown", "Unexpected credential type")
+      }
+      guard !assertion.rawAuthenticatorData.isEmpty else {
+        throw passkeyError("unknown", "Missing authenticator data")
+      }
+      guard !assertion.signature.isEmpty else {
+        throw passkeyError("unknown", "Missing signature")
+      }
+      var attachment = "platform"
+      if #available(iOS 16.6, *) {
+        attachment = Self.attachmentName(assertion.attachment)
+      }
+      return try PasskeyJSON.encode(
+        PasskeyJSON.AssertionResponse(
+          credentialID: assertion.credentialID,
+          clientDataJSON: assertion.rawClientDataJSON,
+          authenticatorData: assertion.rawAuthenticatorData,
+          signature: assertion.signature,
+          userID: assertion.userID,
+          attachment: attachment
+        )
+      )
+    }
+  }
+
+  @available(iOS 16.6, *)
+  private static func attachmentName(_ attachment: ASAuthorizationPublicKeyCredentialAttachment) -> String {
+    switch attachment {
+    case .platform:
+      return "platform"
+    case .crossPlatform:
+      return "cross-platform"
+    @unknown default:
+      return "platform"
+    }
+  }
+
+  // MARK: Anchor
+
+  /// Key window of the foreground-active scene, else the first window of any connected scene.
+  private static func presentationWindow() -> UIWindow? {
+    let scenes = UIApplication.shared.connectedScenes.compactMap { $0 as? UIWindowScene }
+    let activeScene = scenes.first { $0.activationState == .foregroundActive }
+    if let keyWindow = activeScene?.keyWindow {
+      return keyWindow
+    }
+    return scenes.lazy.compactMap { $0.windows.first }.first
+  }
+}

package/ios/PasskeyErrorToken.swift

@@ -0,0 +1,32 @@
+import AuthenticationServices
+import Foundation
+
+/// Maps native errors to the `[Passkeys:<token>]` tokens that `PasskeyError.from` parses in JS.
+enum PasskeyErrorToken {
+  private static let notAssociatedMarker = "is not associated with domain"
+
+  static func token(for error: Error) -> String {
+    let nsError = error as NSError
+    guard nsError.domain == ASAuthorizationError.errorDomain else { return "unknown" }
+    if nsError.code == ASAuthorizationError.Code.failed.rawValue, isDomainNotAssociated(nsError) {
+      return "domainNotAssociated"
+    }
+    return "asauth-\(nsError.code)"
+  }
+
+  /// True when the error (or any underlying error) says the app is not associated with the RP
+  /// domain, i.e. the Associated Domains entitlement or the AASA file is missing or wrong.
+  static func isDomainNotAssociated(_ error: NSError) -> Bool {
+    if error.localizedDescription.contains(notAssociatedMarker) { return true }
+    let reason = error.userInfo[NSLocalizedFailureReasonErrorKey] as? String
+    if reason?.contains(notAssociatedMarker) == true { return true }
+    if let underlying = error.userInfo[NSUnderlyingErrorKey] as? NSError {
+      return isDomainNotAssociated(underlying)
+    }
+    return false
+  }
+
+  static func message(token: String, _ text: String) -> String {
+    "[Passkeys:\(token)] \(text)"
+  }
+}