react-native-nitro-storage 0.5.6 → 0.5.8

package/ios/IOSStorageAdapterCpp.mm

@@ -190,61 +190,27 @@ static NSMutableDictionary* allAccountsQuery(NSString* service, NSString* access
     return query;
 }
 
-static std::vector<std::string> keychainAccountsForService(NSString* service, NSString* accessGroup) {
-    NSMutableDictionary* query = allAccountsQuery(service, accessGroup);
-    disableKeychainInteraction(query);
-    CFTypeRef result = NULL;
-    std::vector<std::string> keys;
-    OSStatus status = SecItemCopyMatching((__bridge CFDictionaryRef)query, &result);
-    if (status == errSecInteractionNotAllowed) {
-        throw taggedStorageError(
-            "keychain_locked",
-            "NitroStorage: Keychain is locked (errSecInteractionNotAllowed). "
-            "The item is not accessible until the device is unlocked."
-        );
-    }
-    if (status == errSecSuccess && result) {
-        id items = (__bridge_transfer id)result;
-        NSArray* itemArray = nil;
-        if ([items isKindOfClass:[NSArray class]]) {
-            itemArray = (NSArray*)items;
-        } else if ([items isKindOfClass:[NSDictionary class]]) {
-            itemArray = @[(NSDictionary*)items];
-        }
-        if (itemArray) {
-            keys.reserve(itemArray.count);
-            for (NSDictionary* item in itemArray) {
-                NSString* account = item[(__bridge id)kSecAttrAccount];
-                if (account) {
-                    keys.push_back(std::string([account UTF8String]));
-                }
-            }
-        }
-    }
-    return keys;
+static NSString* nsStringFromStdString(const std::string& value) {
+    return [NSString stringWithUTF8String:value.c_str()];
 }
 
-void IOSStorageAdapterCpp::setSecure(const std::string& key, const std::string& value) {
-    NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
-    NSData* data = [[NSString stringWithUTF8String:value.c_str()] dataUsingEncoding:NSUTF8StringEncoding];
-    std::string groupStr;
-    int accessControlLevel;
-    {
-        std::lock_guard<std::mutex> lock(accessGroupMutex_);
-        groupStr = keychainAccessGroup_;
-        accessControlLevel = accessControlLevel_;
-    }
-    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
-    NSMutableDictionary* query = baseKeychainQuery(nsKey, kKeychainService, group);
+static NSData* nsDataFromStdString(const std::string& value) {
+    return [nsStringFromStdString(value) dataUsingEncoding:NSUTF8StringEncoding];
+}
 
+static void setSecureValue(
+    NSString* nsKey,
+    NSData* data,
+    NSString* group,
+    int accessControlLevel
+) {
+    NSMutableDictionary* query = baseKeychainQuery(nsKey, kKeychainService, group);
     NSDictionary* updateAttributes = @{
         (__bridge id)kSecValueData: data
     };
 
     OSStatus status = SecItemUpdate((__bridge CFDictionaryRef)query, (__bridge CFDictionaryRef)updateAttributes);
-
     if (status == errSecSuccess) {
-        markSecureKeySet(key);
         return;
     }
 
@@ -252,20 +218,19 @@ void IOSStorageAdapterCpp::setSecure(const std::string& key, const std::string&
         query[(__bridge id)kSecValueData] = data;
         query[(__bridge id)kSecAttrAccessible] = (__bridge id)accessControlAttr(accessControlLevel);
         const OSStatus addStatus = SecItemAdd((__bridge CFDictionaryRef)query, NULL);
-        if (addStatus != errSecSuccess) {
-            if (addStatus == errSecInteractionNotAllowed) {
-                throw taggedStorageError(
-                    "keychain_locked",
-                    "NitroStorage: Keychain is locked (errSecInteractionNotAllowed). "
-                    "The item is not accessible until the device is unlocked."
-                );
-            }
-            throw std::runtime_error(
-                "NitroStorage: Secure set failed with status " + std::to_string(addStatus)
+        if (addStatus == errSecSuccess) {
+            return;
+        }
+        if (addStatus == errSecInteractionNotAllowed) {
+            throw taggedStorageError(
+                "keychain_locked",
+                "NitroStorage: Keychain is locked (errSecInteractionNotAllowed). "
+                "The item is not accessible until the device is unlocked."
             );
         }
-        markSecureKeySet(key);
-        return;
+        throw std::runtime_error(
+            "NitroStorage: Secure set failed with status " + std::to_string(addStatus)
+        );
     }
 
     if (status == errSecInteractionNotAllowed) {
@@ -280,14 +245,7 @@ void IOSStorageAdapterCpp::setSecure(const std::string& key, const std::string&
     );
 }
 
-std::optional<std::string> IOSStorageAdapterCpp::getSecure(const std::string& key) {
-    NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
-    std::string groupStr;
-    {
-        std::lock_guard<std::mutex> lock(accessGroupMutex_);
-        groupStr = keychainAccessGroup_;
-    }
-    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
+static std::optional<std::string> getSecureValue(NSString* nsKey, NSString* group) {
     NSMutableDictionary* query = baseKeychainQuery(nsKey, kKeychainService, group);
     query[(__bridge id)kSecReturnData] = @YES;
     query[(__bridge id)kSecMatchLimit] = (__bridge id)kSecMatchLimitOne;
@@ -310,15 +268,7 @@ std::optional<std::string> IOSStorageAdapterCpp::getSecure(const std::string& ke
     return std::nullopt;
 }
 
-void IOSStorageAdapterCpp::deleteSecure(const std::string& key) {
-    NSString* nsKey = [NSString stringWithUTF8String:key.c_str()];
-    std::string groupStr;
-    {
-        std::lock_guard<std::mutex> lock(accessGroupMutex_);
-        groupStr = keychainAccessGroup_;
-    }
-    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
-
+static void deleteSecureValue(NSString* nsKey, NSString* group) {
     NSMutableDictionary* secureQuery = baseKeychainQuery(nsKey, kKeychainService, group);
     OSStatus secureStatus = SecItemDelete((__bridge CFDictionaryRef)secureQuery);
     if (secureStatus == errSecInteractionNotAllowed) {
@@ -338,9 +288,77 @@ void IOSStorageAdapterCpp::deleteSecure(const std::string& key) {
             "The item is not accessible until the device is unlocked."
         );
     }
+}
+
+static std::vector<std::string> keychainAccountsForService(NSString* service, NSString* accessGroup) {
+    NSMutableDictionary* query = allAccountsQuery(service, accessGroup);
+    disableKeychainInteraction(query);
+    CFTypeRef result = NULL;
+    std::vector<std::string> keys;
+    OSStatus status = SecItemCopyMatching((__bridge CFDictionaryRef)query, &result);
+    if (status == errSecInteractionNotAllowed) {
+        throw taggedStorageError(
+            "keychain_locked",
+            "NitroStorage: Keychain is locked (errSecInteractionNotAllowed). "
+            "The item is not accessible until the device is unlocked."
+        );
+    }
+    if (status == errSecSuccess && result) {
+        id items = (__bridge_transfer id)result;
+        NSArray* itemArray = nil;
+        if ([items isKindOfClass:[NSArray class]]) {
+            itemArray = (NSArray*)items;
+        } else if ([items isKindOfClass:[NSDictionary class]]) {
+            itemArray = @[(NSDictionary*)items];
+        }
+        if (itemArray) {
+            keys.reserve(itemArray.count);
+            for (NSDictionary* item in itemArray) {
+                NSString* account = item[(__bridge id)kSecAttrAccount];
+                if (account) {
+                    keys.push_back(std::string([account UTF8String]));
+                }
+            }
+        }
+    }
+    return keys;
+}
+
+void IOSStorageAdapterCpp::setSecure(const std::string& key, const std::string& value) {
+    NSString* nsKey = nsStringFromStdString(key);
+    NSData* data = nsDataFromStdString(value);
+    std::string groupStr;
+    int accessControlLevel;
+    {
+        std::lock_guard<std::mutex> lock(accessGroupMutex_);
+        groupStr = keychainAccessGroup_;
+        accessControlLevel = accessControlLevel_;
+    }
+    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
+    setSecureValue(nsKey, data, group, accessControlLevel);
+    markSecureKeySet(key);
+}
+
+std::optional<std::string> IOSStorageAdapterCpp::getSecure(const std::string& key) {
+    NSString* nsKey = nsStringFromStdString(key);
+    std::string groupStr;
+    {
+        std::lock_guard<std::mutex> lock(accessGroupMutex_);
+        groupStr = keychainAccessGroup_;
+    }
+    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
+    return getSecureValue(nsKey, group);
+}
 
-    // errSecItemNotFound means the item was already gone — that's fine (idempotent).
-    // Only update the cache if the delete actually ran (success or item-not-found).
+void IOSStorageAdapterCpp::deleteSecure(const std::string& key) {
+    NSString* nsKey = nsStringFromStdString(key);
+    std::string groupStr;
+    {
+        std::lock_guard<std::mutex> lock(accessGroupMutex_);
+        groupStr = keychainAccessGroup_;
+    }
+    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
+    deleteSecureValue(nsKey, group);
     markSecureKeyRemoved(key);
     markBiometricKeyRemoved(key);
 }
@@ -400,25 +418,53 @@ void IOSStorageAdapterCpp::setSecureBatch(
     const std::vector<std::string>& keys,
     const std::vector<std::string>& values
 ) {
+    std::string groupStr;
+    int accessControlLevel;
+    {
+        std::lock_guard<std::mutex> lock(accessGroupMutex_);
+        groupStr = keychainAccessGroup_;
+        accessControlLevel = accessControlLevel_;
+    }
+    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
     for (size_t i = 0; i < keys.size() && i < values.size(); ++i) {
-        setSecure(keys[i], values[i]);
+        setSecureValue(
+            nsStringFromStdString(keys[i]),
+            nsDataFromStdString(values[i]),
+            group,
+            accessControlLevel
+        );
+        markSecureKeySet(keys[i]);
     }
 }
 
 std::vector<std::optional<std::string>> IOSStorageAdapterCpp::getSecureBatch(
     const std::vector<std::string>& keys
 ) {
+    std::string groupStr;
+    {
+        std::lock_guard<std::mutex> lock(accessGroupMutex_);
+        groupStr = keychainAccessGroup_;
+    }
+    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
     std::vector<std::optional<std::string>> results;
     results.reserve(keys.size());
     for (const auto& key : keys) {
-        results.push_back(getSecure(key));
+        results.push_back(getSecureValue(nsStringFromStdString(key), group));
     }
     return results;
 }
 
 void IOSStorageAdapterCpp::deleteSecureBatch(const std::vector<std::string>& keys) {
+    std::string groupStr;
+    {
+        std::lock_guard<std::mutex> lock(accessGroupMutex_);
+        groupStr = keychainAccessGroup_;
+    }
+    NSString* group = groupStr.empty() ? nil : [NSString stringWithUTF8String:groupStr.c_str()];
     for (const auto& key : keys) {
-        deleteSecure(key);
+        deleteSecureValue(nsStringFromStdString(key), group);
+        markSecureKeyRemoved(key);
+        markBiometricKeyRemoved(key);
     }
 }