react-native-nitro-storage 0.10.4 → 0.11.0

package/android/src/main/java/com/nitrostorage/AndroidStorageAdapter.kt

@@ -65,20 +65,44 @@ class AndroidStorageAdapter private constructor(private val context: Context) {
 
     private val masterKeyAlias = "${context.packageName}.nitro_storage.master_key"
 
-    private val masterKey: MasterKey = try {
-        MasterKey.Builder(context, masterKeyAlias)
-            .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
-            .build()
-    } catch (e: Exception) {
-        throw RuntimeException("NitroStorage: Cannot create encryption key. Device may not support AES256-GCM.", e)
+    private val masterKey: MasterKey by lazy {
+        try {
+            createDefaultMasterKey()
+        } catch (e: Exception) {
+            throw permanentSecureStoreError(
+                "NitroStorage: Cannot create the Secure encryption key.",
+                e,
+            )
+        }
     }
 
-    private val encryptedPreferences: SharedPreferences = initializeEncryptedPreferences(
-        "NitroStorageSecure",
-        masterKey,
-        masterKeyAlias,
-        ::createDefaultMasterKey,
-    )
+    private val encryptedPreferences: SharedPreferences by lazy {
+        try {
+            initializeEncryptedPreferences(
+                "NitroStorageSecure",
+                masterKey,
+                masterKeyAlias,
+                ::createDefaultMasterKey,
+            )
+        } catch (e: Exception) {
+            throw permanentSecureStoreError(
+                "NitroStorage: Cannot open Secure storage.",
+                e,
+            )
+        }
+    }
+
+    private fun permanentSecureStoreError(message: String, cause: Exception): RuntimeException {
+        if (cause.message?.contains("[nitro-error:storage_corruption]") == true &&
+            cause is RuntimeException
+        ) {
+            return cause
+        }
+        return RuntimeException(
+            "[nitro-error:storage_corruption] $message ${cause.message ?: ""}".trimEnd(),
+            cause,
+        )
+    }
 
     private val biometricMasterKeyAlias = "${context.packageName}.nitro_storage.biometric_key"
     private val biometricOrPasscodeMasterKeyAlias =
@@ -273,25 +297,55 @@ class AndroidStorageAdapter private constructor(private val context: Context) {
 
     private fun existingBiometricPreferences(): List<SharedPreferences> {
         val stores = mutableListOf<SharedPreferences>()
+        if (
+            biometricOrPasscodeInitialized ||
+            preferencesFileExists("NitroStorageBiometricOrPasscode")
+        ) {
+            stores.add(biometricOrPasscodePreferences)
+        }
+        if (
+            legacyBiometricInitialized ||
+            preferencesFileExists("NitroStorageBiometric")
+        ) {
+            stores.add(legacyBiometricPreferences)
+        }
         if (
             biometricOnlyInitialized ||
             preferencesFileExists("NitroStorageBiometricOnly")
         ) {
             stores.add(biometricOnlyPreferences)
         }
+        return stores
+    }
+
+    private fun <T : Any> firstInExistingBiometricPreferences(
+        lookup: (SharedPreferences) -> T?,
+    ): T? {
         if (
             biometricOrPasscodeInitialized ||
             preferencesFileExists("NitroStorageBiometricOrPasscode")
         ) {
-            stores.add(biometricOrPasscodePreferences)
+            lookup(biometricOrPasscodePreferences)?.let { return it }
         }
         if (
             legacyBiometricInitialized ||
             preferencesFileExists("NitroStorageBiometric")
         ) {
-            stores.add(legacyBiometricPreferences)
+            lookup(legacyBiometricPreferences)?.let { return it }
         }
-        return stores
+        if (
+            biometricOnlyInitialized ||
+            preferencesFileExists("NitroStorageBiometricOnly")
+        ) {
+            lookup(biometricOnlyPreferences)?.let { return it }
+        }
+        return null
+    }
+
+    private fun biometricPreferencesContain(key: String): Boolean {
+        return firstInExistingBiometricPreferences { preferences ->
+            if (preferences.contains(key)) true else null
+        } ?: false
     }
 
     private fun biometricPreferencesForLevel(level: Int): SharedPreferences {
@@ -663,7 +717,7 @@ class AndroidStorageAdapter private constructor(private val context: Context) {
             if (inst.encryptedPreferences.contains(key)) {
                 return true
             }
-            return inst.existingBiometricPreferences().any { it.contains(key) }
+            return inst.biometricPreferencesContain(key)
         }
 
         @JvmStatic
@@ -776,13 +830,9 @@ class AndroidStorageAdapter private constructor(private val context: Context) {
         fun getSecureBiometric(key: String): String? {
             val inst = getInstanceOrThrow()
             return try {
-                for (preferences in inst.existingBiometricPreferences()) {
-                    val value = inst.getSecureSafe(preferences, key)
-                    if (value != null) {
-                        return value
-                    }
+                inst.firstInExistingBiometricPreferences { preferences ->
+                    inst.getSecureSafe(preferences, key)
                 }
-                null
             } catch (e: Exception) {
                 throw e.wrapStorageException(
                     "NitroStorage: Failed to read biometric storage: ${e.message}",
@@ -809,7 +859,7 @@ class AndroidStorageAdapter private constructor(private val context: Context) {
         fun hasSecureBiometric(key: String): Boolean {
             val inst = getInstanceOrThrow()
             return try {
-                inst.existingBiometricPreferences().any { it.contains(key) }
+                inst.biometricPreferencesContain(key)
             } catch (e: Exception) {
                 throw e.wrapStorageException(
                     "NitroStorage: Failed to inspect biometric storage: ${e.message}",

package/android/src/main/java/com/nitrostorage/DiskSqliteStore.kt

@@ -44,6 +44,7 @@ internal class DiskSqliteStore(
     @Synchronized
     fun remove(key: String) {
         db.execSQL("DELETE FROM kv WHERE key = ?", arrayOf(key))
+        removeLegacyKeys(listOf(key))
     }
 
     @Synchronized
@@ -86,6 +87,7 @@ internal class DiskSqliteStore(
         } finally {
             db.endTransaction()
         }
+        removeLegacyKeys(keys.asIterable())
     }
 
     @Synchronized
@@ -135,6 +137,9 @@ internal class DiskSqliteStore(
     @Synchronized
     fun clear() {
         db.execSQL("DELETE FROM kv")
+        if (legacyPreferences.all.isNotEmpty()) {
+            legacyPreferences.edit().clear().apply()
+        }
     }
 
     private fun migrateLegacyPreferences() {
@@ -167,6 +172,16 @@ internal class DiskSqliteStore(
         }
     }
 
+    private fun removeLegacyKeys(keys: Iterable<String>) {
+        val present = keys.filter { legacyPreferences.contains(it) }
+        if (present.isEmpty()) {
+            return
+        }
+        val editor = legacyPreferences.edit()
+        present.forEach { editor.remove(it) }
+        editor.apply()
+    }
+
     private companion object {
         const val DATABASE_NAME = "nitro-storage-disk.sqlite"
         const val PREFS_MIGRATION_KEY = "prefs_v1"

package/app.plugin.js

@@ -1,11 +1,11 @@
+const fs = require("fs");
+const path = require("path");
 const {
   withInfoPlist,
   withAndroidManifest,
   withDangerousMod,
   createRunOncePlugin,
-} = require("@expo/config-plugins");
-const fs = require("fs");
-const path = require("path");
+} = require("expo/config-plugins");
 const pkg = require("./package.json");
 
 const DATA_EXTRACTION_RULES_RESOURCE =
@@ -84,63 +84,61 @@ function writeAndroidBackupFiles(projectRoot) {
   );
 }
 
-const withNitroStorage = (config, props = {}) => {
-  const defaultFaceIDPermission =
-    "Allow $(PRODUCT_NAME) to use Face ID for secure authentication";
-  const {
-    faceIDPermission,
-    addBiometricPermissions = false,
-    configureAndroidBackup = true,
-  } = props;
-
-  config = withInfoPlist(config, (config) => {
-    if (
-      typeof faceIDPermission === "string" &&
-      faceIDPermission.trim() !== ""
-    ) {
-      config.modResults.NSFaceIDUsageDescription = faceIDPermission;
-    } else if (!config.modResults.NSFaceIDUsageDescription) {
-      config.modResults.NSFaceIDUsageDescription = defaultFaceIDPermission;
-    }
-    return config;
-  });
+const DEFAULT_FACE_ID_PERMISSION =
+  "Allow $(PRODUCT_NAME) to use Face ID for secure authentication";
 
-  config = withAndroidManifest(config, (config) => {
-    if (configureAndroidBackup) {
-      ensureBackupAttributes(config.modResults);
-    }
+const BIOMETRIC_PERMISSIONS = [
+  "android.permission.USE_BIOMETRIC",
+  "android.permission.USE_FINGERPRINT",
+];
 
-    if (!addBiometricPermissions) {
-      return config;
-    }
+function applyInfoPlist(infoPlist, props = {}) {
+  const { faceIDPermission } = props;
+  if (typeof faceIDPermission === "string" && faceIDPermission.trim() !== "") {
+    infoPlist.NSFaceIDUsageDescription = faceIDPermission;
+  } else if (!infoPlist.NSFaceIDUsageDescription) {
+    infoPlist.NSFaceIDUsageDescription = DEFAULT_FACE_ID_PERMISSION;
+  }
+  return infoPlist;
+}
 
-    if (!config.modResults.manifest["uses-permission"]) {
-      config.modResults.manifest["uses-permission"] = [];
-    }
+function applyAndroidManifest(androidManifest, props = {}) {
+  const { addBiometricPermissions = false, configureAndroidBackup = true } =
+    props;
 
-    const permissions = config.modResults.manifest["uses-permission"];
+  if (configureAndroidBackup) {
+    ensureBackupAttributes(androidManifest);
+  }
 
-    const biometricPermission = {
-      $: { "android:name": "android.permission.USE_BIOMETRIC" },
-    };
-    const fingerprintPermission = {
-      $: { "android:name": "android.permission.USE_FINGERPRINT" },
-    };
+  if (!addBiometricPermissions) {
+    return androidManifest;
+  }
 
-    const hasBiometric = permissions.some(
-      (p) => p.$?.["android:name"] === "android.permission.USE_BIOMETRIC",
-    );
-    const hasFingerprint = permissions.some(
-      (p) => p.$?.["android:name"] === "android.permission.USE_FINGERPRINT",
-    );
+  if (!androidManifest.manifest["uses-permission"]) {
+    androidManifest.manifest["uses-permission"] = [];
+  }
 
-    if (!hasBiometric) {
-      permissions.push(biometricPermission);
-    }
-    if (!hasFingerprint) {
-      permissions.push(fingerprintPermission);
+  const permissions = androidManifest.manifest["uses-permission"];
+  for (const name of BIOMETRIC_PERMISSIONS) {
+    const present = permissions.some((p) => p.$?.["android:name"] === name);
+    if (!present) {
+      permissions.push({ $: { "android:name": name } });
     }
+  }
+
+  return androidManifest;
+}
+
+const withNitroStorage = (config, props = {}) => {
+  const { configureAndroidBackup = true } = props;
+
+  config = withInfoPlist(config, (config) => {
+    applyInfoPlist(config.modResults, props);
+    return config;
+  });
 
+  config = withAndroidManifest(config, (config) => {
+    applyAndroidManifest(config.modResults, props);
     return config;
   });
 
@@ -164,6 +162,8 @@ module.exports = createRunOncePlugin(
 );
 module.exports.withNitroStorage = withNitroStorage;
 module.exports._internal = {
+  applyInfoPlist,
+  applyAndroidManifest,
   dataExtractionRulesXml,
   fullBackupContentXml,
   ensureBackupAttributes,

package/cpp/bindings/HybridStorage.cpp

@@ -1,4 +1,5 @@
 #include "HybridStorage.hpp"
+#include <algorithm>
 #include <cmath>
 #include <stdexcept>
 
@@ -32,8 +33,8 @@ HybridStorage::HybridStorage()
 #if __APPLE__
     nativeAdapter_ = std::make_shared<::NitroStorage::IOSStorageAdapterCpp>();
 #elif __ANDROID__
-    auto context = ::NitroStorage::AndroidStorageAdapterJava::getContext();
-    nativeAdapter_ = std::make_shared<::NitroStorage::AndroidStorageAdapterCpp>(context);
+    ::NitroStorage::AndroidStorageAdapterJava::ensureInitialized();
+    nativeAdapter_ = std::make_shared<::NitroStorage::AndroidStorageAdapterCpp>();
 #endif
 #endif
 }
@@ -338,8 +339,17 @@ void HybridStorage::setBatch(const std::vector<std::string>& keys, const std::ve
             break;
         case Scope::Secure:
             ensureAdapter();
-            runAdapterOperation(
-                [&] { nativeAdapter_->setSecureBatch(keys, values); }, "Secure setBatch");
+            try {
+                runAdapterOperation(
+                    [&] { nativeAdapter_->setSecureBatch(keys, values); }, "Secure setBatch");
+            } catch (const ::NitroStorage::PartialBatchError& error) {
+                const auto listeners = copyListenersForScope(static_cast<int>(s));
+                const auto applied = std::min(error.appliedCount(), keys.size());
+                for (size_t i = 0; i < applied; ++i) {
+                    notifyListeners(listeners, keys[i], values[i]);
+                }
+                throw;
+            }
             break;
     }
 
@@ -402,8 +412,17 @@ void HybridStorage::removeBatch(const std::vector<std::string>& keys, double sco
             break;
         case Scope::Secure:
             ensureAdapter();
-            runAdapterOperation(
-                [&] { nativeAdapter_->deleteSecureBatch(keys); }, "Secure removeBatch");
+            try {
+                runAdapterOperation(
+                    [&] { nativeAdapter_->deleteSecureBatch(keys); }, "Secure removeBatch");
+            } catch (const ::NitroStorage::PartialBatchError& error) {
+                const auto listeners = copyListenersForScope(static_cast<int>(s));
+                const auto applied = std::min(error.appliedCount(), keys.size());
+                for (size_t i = 0; i < applied; ++i) {
+                    notifyListeners(listeners, keys[i], std::nullopt);
+                }
+                throw;
+            }
             break;
     }
 

package/cpp/core/NativeStorageAdapter.hpp

@@ -1,11 +1,24 @@
 #pragma once
 
-#include <string>
+#include <cstddef>
 #include <optional>
+#include <stdexcept>
+#include <string>
 #include <vector>
 
 namespace NitroStorage {
 
+class PartialBatchError : public std::runtime_error {
+public:
+    PartialBatchError(size_t appliedCount, const std::string& message)
+        : std::runtime_error(message), appliedCount_(appliedCount) {}
+
+    size_t appliedCount() const noexcept { return appliedCount_; }
+
+private:
+    size_t appliedCount_;
+};
+
 class NativeStorageAdapter {
 public:
     virtual ~NativeStorageAdapter() = default;

package/cpp/core/SqliteDiskStore.cpp

@@ -61,7 +61,12 @@ std::string escapeLikePrefix(const std::string& prefix) {
 
 SqliteDiskStore::SqliteDiskStore(std::string path) : path_(std::move(path)) {
     std::lock_guard<std::mutex> lock(mutex_);
-    openLocked();
+    try {
+        openLocked();
+    } catch (...) {
+        closeLocked();
+        throw;
+    }
 }
 
 SqliteDiskStore::~SqliteDiskStore() {
@@ -121,6 +126,12 @@ void SqliteDiskStore::openLocked() {
         "value TEXT NOT NULL"
         ");"
     );
+    execLocked(
+        "CREATE TABLE IF NOT EXISTS meta ("
+        "k TEXT PRIMARY KEY NOT NULL,"
+        "v TEXT NOT NULL"
+        ");"
+    );
     setStmt_ = prepareLocked("INSERT OR REPLACE INTO kv(key, value) VALUES(?1, ?2);");
     getStmt_ = prepareLocked("SELECT value FROM kv WHERE key = ?1;");
     removeStmt_ = prepareLocked("DELETE FROM kv WHERE key = ?1;");
@@ -132,6 +143,8 @@ void SqliteDiskStore::openLocked() {
     insertAbsentStmt_ = prepareLocked(
         "INSERT OR IGNORE INTO kv(key, value) VALUES(?1, ?2);"
     );
+    getMetaStmt_ = prepareLocked("SELECT 1 FROM meta WHERE k = ?1 LIMIT 1;");
+    setMetaStmt_ = prepareLocked("INSERT OR REPLACE INTO meta(k, v) VALUES(?1, ?2);");
 }
 
 void SqliteDiskStore::closeLocked() {
@@ -150,6 +163,8 @@ void SqliteDiskStore::closeLocked() {
     finalize(sizeStmt_);
     finalize(clearStmt_);
     finalize(insertAbsentStmt_);
+    finalize(getMetaStmt_);
+    finalize(setMetaStmt_);
     if (db_ != nullptr) {
         sqlite3_close(db_);
         db_ = nullptr;
@@ -386,6 +401,49 @@ void SqliteDiskStore::clear() {
     }
 }
 
+void SqliteDiskStore::insertAbsentLocked(
+    const std::vector<std::pair<std::string, std::string>>& entries
+) {
+    for (const auto& entry : entries) {
+        sqlite3_reset(insertAbsentStmt_);
+        sqlite3_clear_bindings(insertAbsentStmt_);
+        bindText(insertAbsentStmt_, 1, entry.first);
+        bindText(insertAbsentStmt_, 2, entry.second);
+        const int rc = sqlite3_step(insertAbsentStmt_);
+        sqlite3_reset(insertAbsentStmt_);
+        if (rc != SQLITE_DONE) {
+            throwSqlite(db_, "migrate", rc);
+        }
+    }
+}
+
+bool SqliteDiskStore::hasMigrationMarkerLocked(const std::string& name) {
+    sqlite3_reset(getMetaStmt_);
+    sqlite3_clear_bindings(getMetaStmt_);
+    bindText(getMetaStmt_, 1, name);
+    const int rc = sqlite3_step(getMetaStmt_);
+    sqlite3_reset(getMetaStmt_);
+    if (rc == SQLITE_ROW) {
+        return true;
+    }
+    if (rc == SQLITE_DONE) {
+        return false;
+    }
+    throwSqlite(db_, "hasMigrationMarker", rc);
+}
+
+void SqliteDiskStore::setMigrationMarkerLocked(const std::string& name) {
+    sqlite3_reset(setMetaStmt_);
+    sqlite3_clear_bindings(setMetaStmt_);
+    bindText(setMetaStmt_, 1, name);
+    bindText(setMetaStmt_, 2, "1");
+    const int rc = sqlite3_step(setMetaStmt_);
+    sqlite3_reset(setMetaStmt_);
+    if (rc != SQLITE_DONE) {
+        throwSqlite(db_, "setMigrationMarker", rc);
+    }
+}
+
 void SqliteDiskStore::migrateIfAbsent(
     const std::vector<std::pair<std::string, std::string>>& entries
 ) {
@@ -395,17 +453,32 @@ void SqliteDiskStore::migrateIfAbsent(
     std::lock_guard<std::mutex> lock(mutex_);
     beginLocked();
     try {
-        for (const auto& entry : entries) {
-            sqlite3_reset(insertAbsentStmt_);
-            sqlite3_clear_bindings(insertAbsentStmt_);
-            bindText(insertAbsentStmt_, 1, entry.first);
-            bindText(insertAbsentStmt_, 2, entry.second);
-            const int rc = sqlite3_step(insertAbsentStmt_);
-            sqlite3_reset(insertAbsentStmt_);
-            if (rc != SQLITE_DONE) {
-                throwSqlite(db_, "migrate", rc);
-            }
+        insertAbsentLocked(entries);
+        commitLocked();
+    } catch (...) {
+        rollbackLocked();
+        throw;
+    }
+}
+
+bool SqliteDiskStore::hasMigrationMarker(const std::string& name) {
+    std::lock_guard<std::mutex> lock(mutex_);
+    return hasMigrationMarkerLocked(name);
+}
+
+void SqliteDiskStore::migrateOnce(
+    const std::string& name,
+    const std::vector<std::pair<std::string, std::string>>& entries
+) {
+    std::lock_guard<std::mutex> lock(mutex_);
+    beginLocked();
+    try {
+        if (hasMigrationMarkerLocked(name)) {
+            commitLocked();
+            return;
         }
+        insertAbsentLocked(entries);
+        setMigrationMarkerLocked(name);
         commitLocked();
     } catch (...) {
         rollbackLocked();

package/cpp/core/SqliteDiskStore.hpp

@@ -39,6 +39,11 @@ public:
     size_t size();
     void clear();
     void migrateIfAbsent(const std::vector<std::pair<std::string, std::string>>& entries);
+    bool hasMigrationMarker(const std::string& name);
+    void migrateOnce(
+        const std::string& name,
+        const std::vector<std::pair<std::string, std::string>>& entries
+    );
 
 private:
     void openLocked();
@@ -50,6 +55,9 @@ private:
     void setLocked(const std::string& key, const std::string& value);
     std::optional<std::string> getLocked(const std::string& key);
     void removeLocked(const std::string& key);
+    void insertAbsentLocked(const std::vector<std::pair<std::string, std::string>>& entries);
+    bool hasMigrationMarkerLocked(const std::string& name);
+    void setMigrationMarkerLocked(const std::string& name);
     sqlite3_stmt* prepareLocked(const char* sql);
 
     std::string path_;
@@ -63,6 +71,8 @@ private:
     sqlite3_stmt* sizeStmt_ = nullptr;
     sqlite3_stmt* clearStmt_ = nullptr;
     sqlite3_stmt* insertAbsentStmt_ = nullptr;
+    sqlite3_stmt* getMetaStmt_ = nullptr;
+    sqlite3_stmt* setMetaStmt_ = nullptr;
     std::mutex mutex_;
 };