react-native-nitro-storage 0.5.3 → 0.5.5

package/lib/module/index.web.js

@@ -17,6 +17,20 @@ function isUpdater(valueOrFn) {
 function typedKeys(record) {
   return Object.keys(record);
 }
+function assertEnumInteger(value, min, max, label) {
+  if (!Number.isFinite(value) || value < min || value > max) {
+    throw new Error(`NitroStorage: Invalid ${label}`);
+  }
+  if (value !== Math.trunc(value)) {
+    throw new Error(`NitroStorage: Invalid ${label}`);
+  }
+}
+function assertAccessControlLevel(level) {
+  assertEnumInteger(level, 0, 4, "access control level");
+}
+function assertBiometricLevel(level) {
+  assertEnumInteger(level, 0, 2, "biometric level");
+}
 const registeredMigrations = new Map();
 const runMicrotask = typeof queueMicrotask === "function" ? queueMicrotask : task => {
   Promise.resolve().then(task);
@@ -40,6 +54,7 @@ let hasWarnedAboutWebBiometricFallback = false;
 let hasWindowStorageEventSubscription = false;
 let metricsObserver;
 let eventObserver;
+let eventObserverRedactSecureValues = true;
 const metricsCounters = new Map();
 const storageEvents = new StorageEventRegistry();
 function recordMetric(operation, scope, durationMs, keysCount = 1) {
@@ -235,6 +250,16 @@ function resetBackendChangeSubscription(scope) {
   externalSyncUnsubscribers.get(scope)?.();
   externalSyncUnsubscribers.delete(scope);
 }
+function closeWebBackend(scope, backend) {
+  if (!backend?.close) {
+    return;
+  }
+  try {
+    backend.close();
+  } catch (error) {
+    throw createWebStorageError(scope, "close", error, backend);
+  }
+}
 function ensureExternalSyncSubscriptions() {
   if (!hasWindowStorageEventSubscription && typeof window !== "undefined" && typeof window.addEventListener === "function") {
     window.addEventListener("storage", handleWebStorageEvent);
@@ -315,10 +340,42 @@ function createKeyChange(scope, key, oldValue, newValue, operation, source) {
 function hasStorageChangeObservers(scope) {
   return storageEvents.hasListeners(scope) || eventObserver !== undefined;
 }
+function shouldReadPreviousEventValues(scope) {
+  if (storageEvents.hasListeners(scope)) {
+    return true;
+  }
+  if (!eventObserver) {
+    return false;
+  }
+  return scope !== StorageScope.Secure || !eventObserverRedactSecureValues;
+}
+const SECURE_EVENT_REDACTED_VALUE = "[secure]";
+function redactSecureKeyChange(event) {
+  if (event.scope !== StorageScope.Secure) {
+    return event;
+  }
+  return {
+    ...event,
+    oldValue: event.oldValue === undefined ? undefined : SECURE_EVENT_REDACTED_VALUE,
+    newValue: event.newValue === undefined ? undefined : SECURE_EVENT_REDACTED_VALUE
+  };
+}
+function eventForGlobalObserver(event) {
+  if (!eventObserverRedactSecureValues || event.scope !== StorageScope.Secure) {
+    return event;
+  }
+  if (event.type === "key") {
+    return redactSecureKeyChange(event);
+  }
+  return {
+    ...event,
+    changes: event.changes.map(redactSecureKeyChange)
+  };
+}
 function emitKeyChange(scope, key, oldValue, newValue, operation, source) {
   const event = createKeyChange(scope, key, oldValue, newValue, operation, source);
   storageEvents.emitKey(event);
-  eventObserver?.(event);
+  eventObserver?.(eventForGlobalObserver(event));
 }
 function emitBatchChange(scope, operation, source, changes) {
   if (changes.length === 0) {
@@ -332,7 +389,7 @@ function emitBatchChange(scope, operation, source, changes) {
     changes
   };
   storageEvents.emitBatch(event);
-  eventObserver?.(event);
+  eventObserver?.(eventForGlobalObserver(event));
 }
 function readPendingSecureWrite(key) {
   return pendingSecureWrites.get(key)?.value;
@@ -502,6 +559,9 @@ const WebStorage = {
     if (scope !== StorageScope.Disk && scope !== StorageScope.Secure) {
       return;
     }
+    if (keys.length !== values.length) {
+      throw new Error("NitroStorage: Keys and values size mismatch in setBatch");
+    }
     const entries = [];
     keys.forEach((key, index) => {
       const value = values[index];
@@ -520,7 +580,7 @@ const WebStorage = {
       });
     });
     const keyIndex = ensureWebScopeKeyIndex(scope);
-    keys.forEach(key => keyIndex.add(key));
+    entries.forEach(([storageKey]) => keyIndex.add(scope === StorageScope.Secure ? storageKey.slice(SECURE_WEB_PREFIX.length) : storageKey));
     const listeners = getScopedListeners(scope);
     keys.forEach(key => notifyKeyListeners(listeners, key));
   },
@@ -606,13 +666,25 @@ const WebStorage = {
     }
     return 0;
   },
-  setSecureAccessControl: () => {},
+  setSecureAccessControl: level => {
+    assertAccessControlLevel(level);
+  },
   setSecureWritesAsync: _enabled => {},
   setKeychainAccessGroup: () => {},
   setSecureBiometric: (key, value) => {
     WebStorage.setSecureBiometricWithLevel(key, value, BiometricLevel.BiometryOnly);
   },
-  setSecureBiometricWithLevel: (key, value, _level) => {
+  setSecureBiometricWithLevel: (key, value, level) => {
+    assertBiometricLevel(level);
+    if (level === BiometricLevel.None) {
+      withWebBackendOperation(StorageScope.Secure, "setSecure", backend => {
+        backend.removeItem(toBiometricStorageKey(key));
+        backend.setItem(toSecureStorageKey(key), value);
+      });
+      ensureWebScopeKeyIndex(StorageScope.Secure).add(key);
+      notifyKeyListeners(getScopedListeners(StorageScope.Secure), key);
+      return;
+    }
     if (typeof __DEV__ !== "undefined" && __DEV__ && !hasWarnedAboutWebBiometricFallback) {
       hasWarnedAboutWebBiometricFallback = true;
       console.warn("[NitroStorage] Biometric storage is not supported on web. Using localStorage.");
@@ -765,15 +837,16 @@ export const storage = {
   subscribeNamespace: (namespace, scope, listener) => {
     return storage.subscribePrefix(scope, prefixKey(namespace, ""), listener);
   },
-  setEventObserver: observer => {
+  setEventObserver: (observer, options = {}) => {
     eventObserver = observer;
+    eventObserverRedactSecureValues = options.redactSecureValues !== false;
     if (observer) {
       ensureExternalSyncSubscriptions();
     }
   },
   clear: scope => {
     measureOperation("storage:clear", scope, () => {
-      const previousValues = hasStorageChangeObservers(scope) ? storage.getAll(scope) : {};
+      const previousValues = shouldReadPreviousEventValues(scope) ? storage.getAll(scope) : {};
       if (scope === StorageScope.Memory) {
         memoryStore.clear();
         notifyAllListeners(memoryListeners);
@@ -823,7 +896,7 @@ export const storage = {
         return;
       }
       const keyPrefix = prefixKey(namespace, "");
-      const previousValues = hasStorageChangeObservers(scope) ? storage.getByPrefix(keyPrefix, scope) : {};
+      const previousValues = shouldReadPreviousEventValues(scope) ? storage.getByPrefix(keyPrefix, scope) : {};
       if (scope === StorageScope.Disk) {
         flushDiskWrites();
       }
@@ -946,9 +1019,15 @@ export const storage = {
       return result;
     });
   },
-  export: scope => {
+  export: (scope, options = {}) => {
+    if (scope === StorageScope.Secure && options.includeSecureValues !== true) {
+      throw new Error("NitroStorage: exporting Secure scope exposes raw secret values. Pass { includeSecureValues: true } or use exportSecureUnsafe().");
+    }
     return measureOperation("storage:export", scope, () => storage.getAll(scope));
   },
+  exportSecureUnsafe: () => {
+    return measureOperation("storage:exportSecureUnsafe", StorageScope.Secure, () => storage.getAll(StorageScope.Secure));
+  },
   size: scope => {
     return measureOperation("storage:size", scope, () => {
       assertValidScope(scope);
@@ -963,6 +1042,7 @@ export const storage = {
     });
   },
   setAccessControl: level => {
+    assertAccessControlLevel(level);
     secureDefaultAccessControl = level;
     recordMetric("storage:setAccessControl", StorageScope.Secure, 0);
   },
@@ -1115,23 +1195,33 @@ export const storage = {
   }
 };
 export function setWebSecureStorageBackend(backend) {
+  const previousBackend = webSecureStorageBackend;
+  const nextBackend = backend ?? createDefaultSecureBackend();
   pendingSecureWrites.clear();
-  webSecureStorageBackend = backend ?? createDefaultSecureBackend();
   resetBackendChangeSubscription(StorageScope.Secure);
+  webSecureStorageBackend = nextBackend;
   hydratedWebScopeKeyIndex.delete(StorageScope.Secure);
   clearScopeRawCache(StorageScope.Secure);
   ensureExternalSyncSubscriptions();
+  if (previousBackend !== nextBackend) {
+    closeWebBackend(StorageScope.Secure, previousBackend);
+  }
 }
 export function getWebSecureStorageBackend() {
   return webSecureStorageBackend;
 }
 export function setWebDiskStorageBackend(backend) {
+  const previousBackend = webDiskStorageBackend;
+  const nextBackend = backend ?? createDefaultDiskBackend();
   pendingDiskWrites.clear();
-  webDiskStorageBackend = backend ?? createDefaultDiskBackend();
   resetBackendChangeSubscription(StorageScope.Disk);
+  webDiskStorageBackend = nextBackend;
   hydratedWebScopeKeyIndex.delete(StorageScope.Disk);
   clearScopeRawCache(StorageScope.Disk);
   ensureExternalSyncSubscriptions();
+  if (previousBackend !== nextBackend) {
+    closeWebBackend(StorageScope.Disk, previousBackend);
+  }
 }
 export function getWebDiskStorageBackend() {
   return webDiskStorageBackend;
@@ -1184,6 +1274,12 @@ export function createStorageItem(config) {
   if (expiration && expiration.ttlMs <= 0) {
     throw new Error("expiration.ttlMs must be greater than 0.");
   }
+  if (config.scope === StorageScope.Secure) {
+    assertBiometricLevel(resolvedBiometricLevel);
+    if (secureAccessControl !== undefined) {
+      assertAccessControlLevel(secureAccessControl);
+    }
+  }
   const listeners = new Set();
   let unsubscribe = null;
   let lastRaw = undefined;
@@ -1523,6 +1619,7 @@ export function createStorageItem(config) {
     _hasExpiration: expiration !== undefined,
     _readCacheEnabled: readCache,
     _isBiometric: isBiometric,
+    _biometricLevel: resolvedBiometricLevel,
     _defaultValue: defaultValue,
     ...(secureAccessControl !== undefined ? {
       _secureAccessControl: secureAccessControl
@@ -1654,7 +1751,7 @@ export function setBatch(items, scope) {
       const keys = secureEntries.map(({
         item
       }) => item.key);
-      const oldValues = hasStorageChangeObservers(scope) ? WebStorage.getBatch(keys, scope) : [];
+      const oldValues = shouldReadPreviousEventValues(scope) ? WebStorage.getBatch(keys, scope) : [];
       const groupedByAccessControl = new Map();
       secureEntries.forEach(({
         item,
@@ -1697,7 +1794,7 @@ export function setBatch(items, scope) {
     }
     const keys = items.map(entry => entry.item.key);
     const values = items.map(entry => entry.item.serialize(entry.value));
-    const oldValues = hasStorageChangeObservers(scope) ? WebStorage.getBatch(keys, scope) : [];
+    const oldValues = shouldReadPreviousEventValues(scope) ? WebStorage.getBatch(keys, scope) : [];
     WebStorage.setBatch(keys, values, scope);
     keys.forEach((key, index) => cacheRawValue(scope, key, values[index]));
     emitBatchChange(scope, "setBatch", "web", keys.map((key, index) => createKeyChange(scope, key, oldValues[index], values[index], "setBatch", "web")));
@@ -1719,7 +1816,7 @@ export function removeBatch(items, scope) {
     if (scope === StorageScope.Secure) {
       flushSecureWrites();
     }
-    const oldValues = hasStorageChangeObservers(scope) ? WebStorage.getBatch(keys, scope) : [];
+    const oldValues = shouldReadPreviousEventValues(scope) ? WebStorage.getBatch(keys, scope) : [];
     WebStorage.removeBatch(keys, scope);
     keys.forEach(key => cacheRawValue(scope, key, undefined));
     emitBatchChange(scope, "removeBatch", "web", keys.map((key, index) => createKeyChange(scope, key, oldValues[index], undefined, "removeBatch", "web")));
@@ -1771,14 +1868,32 @@ export function runTransaction(scope, transaction) {
     }
     const NOT_SET = Symbol();
     const rollback = new Map();
-    const rememberRollback = key => {
+    const rememberRollback = (key, item) => {
       if (rollback.has(key)) {
         return;
       }
       if (scope === StorageScope.Memory) {
-        rollback.set(key, memoryStore.has(key) ? memoryStore.get(key) : NOT_SET);
+        rollback.set(key, {
+          kind: "memory",
+          value: memoryStore.has(key) ? memoryStore.get(key) : NOT_SET
+        });
       } else {
-        rollback.set(key, getRawValue(key, scope));
+        const internal = item ? item : undefined;
+        if (scope === StorageScope.Secure && internal?._isBiometric === true) {
+          rollback.set(key, {
+            kind: "biometric",
+            value: WebStorage.getSecureBiometric(key),
+            level: internal._biometricLevel
+          });
+          return;
+        }
+        rollback.set(key, {
+          kind: "raw",
+          value: getRawValue(key, scope),
+          ...(scope === StorageScope.Secure && internal?._secureAccessControl !== undefined ? {
+            accessControl: internal._secureAccessControl
+          } : {})
+        });
       }
     };
     const tx = {
@@ -1798,12 +1913,12 @@ export function runTransaction(scope, transaction) {
       },
       setItem: (item, value) => {
         assertBatchScope([item], scope);
-        rememberRollback(item.key);
+        rememberRollback(item.key, item);
         item.set(value);
       },
       removeItem: item => {
         assertBatchScope([item], scope);
-        rememberRollback(item.key);
+        rememberRollback(item.key, item);
         item.delete();
       }
     };
@@ -1812,24 +1927,43 @@ export function runTransaction(scope, transaction) {
     } catch (error) {
       const rollbackEntries = Array.from(rollback.entries()).reverse();
       if (scope === StorageScope.Memory) {
-        rollbackEntries.forEach(([key, previousValue]) => {
-          if (previousValue === NOT_SET) {
+        rollbackEntries.forEach(([key, record]) => {
+          if (record.value === NOT_SET) {
             memoryStore.delete(key);
           } else {
-            memoryStore.set(key, previousValue);
+            memoryStore.set(key, record.value);
           }
           notifyKeyListeners(memoryListeners, key);
         });
       } else {
-        const keysToSet = [];
-        const valuesToSet = [];
+        const groupedKeysToSet = new Map();
         const keysToRemove = [];
-        rollbackEntries.forEach(([key, previousValue]) => {
-          if (previousValue === undefined) {
+        rollbackEntries.forEach(([key, record]) => {
+          if (record.kind === "biometric") {
+            if (record.value === undefined) {
+              WebStorage.deleteSecureBiometric(key);
+            } else {
+              WebStorage.setSecureBiometricWithLevel(key, record.value, record.level);
+            }
+            return;
+          }
+          if (record.kind !== "raw") {
+            return;
+          }
+          if (record.value === undefined) {
             keysToRemove.push(key);
           } else {
-            keysToSet.push(key);
-            valuesToSet.push(previousValue);
+            const accessControl = record.accessControl ?? secureDefaultAccessControl;
+            const existingGroup = groupedKeysToSet.get(accessControl);
+            const group = existingGroup ?? {
+              keys: [],
+              values: []
+            };
+            group.keys.push(key);
+            group.values.push(record.value);
+            if (!existingGroup) {
+              groupedKeysToSet.set(accessControl, group);
+            }
           }
         });
         if (scope === StorageScope.Disk) {
@@ -1838,10 +1972,13 @@ export function runTransaction(scope, transaction) {
         if (scope === StorageScope.Secure) {
           flushSecureWrites();
         }
-        if (keysToSet.length > 0) {
-          WebStorage.setBatch(keysToSet, valuesToSet, scope);
-          keysToSet.forEach((key, index) => cacheRawValue(scope, key, valuesToSet[index]));
-        }
+        groupedKeysToSet.forEach((group, accessControl) => {
+          if (scope === StorageScope.Secure) {
+            WebStorage.setSecureAccessControl(accessControl);
+          }
+          WebStorage.setBatch(group.keys, group.values, scope);
+          group.keys.forEach((key, index) => cacheRawValue(scope, key, group.values[index]));
+        });
         if (keysToRemove.length > 0) {
           WebStorage.removeBatch(keysToRemove, scope);
           keysToRemove.forEach(key => cacheRawValue(scope, key, undefined));