react-native-oauth-essentials 1.0.11 → 1.1.1

package/ios/OauthEssentialsModule.swift

@@ -2,35 +2,57 @@ import Foundation
 import React
 import GoogleSignIn
 import AuthenticationServices
+import CryptoKit
 import Security
 import UIKit
 
+/// TurboModule methods are called on the module queue. Every method hops to the main thread, so
+/// the retrievers, the simultaneous call lock and all UIKit/AuthenticationServices calls run on main.
 public class OauthEssentialsModule: NSObject {
 
   public var onCredentialSuccess: ((NSDictionary) -> Void)?
   public var onCredentialFailure: ((NSDictionary) -> Void)?
+  public var onAppleIdCredentialRevoked: ((NSDictionary) -> Void)?
 
   private var _password_retriever: PasswordRetriever? = nil
   private var _google_id_retriever: GoogleIdRetriever? = nil
   private var _apple_id_retriever: AppleIdRetriever? = nil
   private var _hybrid_retriever: HybridRetriever? = nil
   private var _passkey_retriever: RCTPromiseSettler? = nil
+  private var _auth_session_retriever: AuthSessionRetriever? = nil
+  private var revokedObserver: NSObjectProtocol?
 
   @objc
   public init(
     onCredentialSuccess: @escaping ((NSDictionary) -> Void),
-    onCredentialFailure: @escaping ((NSDictionary) -> Void)
+    onCredentialFailure: @escaping ((NSDictionary) -> Void),
+    onAppleIdCredentialRevoked: @escaping ((NSDictionary) -> Void)
   ) {
     super.init()
 
     self.onCredentialSuccess = onCredentialSuccess
     self.onCredentialFailure = onCredentialFailure
+    self.onAppleIdCredentialRevoked = onAppleIdCredentialRevoked
+
+    self.revokedObserver = NotificationCenter.default.addObserver(
+      forName: ASAuthorizationAppleIDProvider.credentialRevokedNotification,
+      object: nil,
+      queue: .main
+    ) { [weak self] _ in
+      self?.onAppleIdCredentialRevoked?(["type": "REVOKED"])
+    }
   }
 
-  private func ensurePreviousPromiseSettled(settler: RCTPromiseSettler?, reject: RCTPromiseRejectBlock) -> Bool {
-    if settler == nil || (settler != nil && ((settler?.settled()) != nil)) {
-      return true
+  deinit {
+    if let revokedObserver = revokedObserver {
+      NotificationCenter.default.removeObserver(revokedObserver)
     }
+  }
+
+  /// Returns true when the previous call of the same method already settled its promise.
+  private func ensurePreviousPromiseSettled(settler: RCTPromiseSettler?, reject: RCTPromiseRejectBlock) -> Bool {
+    guard let settler = settler else { return true }
+    if settler.settled() { return true }
 
     reject(
       CredentialError.simultaneousCallError.rawValue,
@@ -65,7 +87,8 @@ public class OauthEssentialsModule: NSObject {
       "GOOGLE_PLAY_SERVICES_SUPPORTED": false, // Not applicable on iOS, it does not have Google Play Services
       "APPLE_ID_SUPPORTED": appleIdSupported,
       "HYBRID_SUPPORTED": passwordSupported || appleIdSupported,
-      "PASSKEYS_SUPPORTED": passkeySupported
+      "PASSKEYS_SUPPORTED": passkeySupported,
+      "OAUTH_REDIRECT_URI": "\((Bundle.main.bundleIdentifier ?? "app").lowercased())://oauth/callback"
     ]
   }
 
@@ -76,11 +99,40 @@ public class OauthEssentialsModule: NSObject {
     resolver resolve: @escaping RCTPromiseResolveBlock,
     rejecter reject: @escaping RCTPromiseRejectBlock
   ) {
-    if (ensurePreviousPromiseSettled(settler: self._google_id_retriever,reject: reject)) {
-      self._google_id_retriever = GoogleIdRetriever(clientId: clientId, options: options,resolve: resolve,reject: reject, emitEvent: emitEvent)
+    DispatchQueue.main.async {
+      if self.ensurePreviousPromiseSettled(settler: self._google_id_retriever, reject: reject) {
+        self._google_id_retriever = GoogleIdRetriever(clientId: clientId, options: options, silent: false, resolve: resolve, reject: reject, emitEvent: self.emitEvent)
+      }
+    }
+  }
+
+  @objc
+  public func googleSilentSignIn(
+    _ clientId: String,
+    options: NSDictionary,
+    resolver resolve: @escaping RCTPromiseResolveBlock,
+    rejecter reject: @escaping RCTPromiseRejectBlock
+  ) {
+    DispatchQueue.main.async {
+      if self.ensurePreviousPromiseSettled(settler: self._google_id_retriever, reject: reject) {
+        self._google_id_retriever = GoogleIdRetriever(clientId: clientId, options: options, silent: true, resolve: resolve, reject: reject, emitEvent: self.emitEvent)
+      }
     }
   }
 
+  @objc
+  public func signOut(
+    _ resolve: @escaping RCTPromiseResolveBlock,
+    rejecter reject: @escaping RCTPromiseRejectBlock
+  ) {
+    DispatchQueue.main.async {
+      GIDSignIn.sharedInstance.signOut()
+      resolve(true)
+    }
+  }
+
+  /// iOS has no API to save a password without an associated domain: let the system offer it
+  /// through the text fields `textContentType` instead.
   @objc
   public func passwordSignIn(
     _ username: String,
@@ -88,9 +140,7 @@ public class OauthEssentialsModule: NSObject {
     resolver resolve: @escaping RCTPromiseResolveBlock,
     rejecter reject: @escaping RCTPromiseRejectBlock
   ) {
-    if (ensurePreviousPromiseSettled(settler: self._apple_id_retriever, reject: reject)) {
-      self._apple_id_retriever = AppleIdRetriever(resolve: resolve, reject: reject, emitEvent: self.emitEvent)
-    }
+    resolve(false)
   }
 
   @objc
@@ -98,9 +148,11 @@ public class OauthEssentialsModule: NSObject {
     _ resolve: @escaping RCTPromiseResolveBlock,
     rejecter reject: @escaping RCTPromiseRejectBlock
   ) {
-      if (ensurePreviousPromiseSettled(settler: self._password_retriever,reject: reject)) {
-        self._password_retriever = PasswordRetriever(resolve: resolve,reject: reject, emitEvent: self.emitEvent)
+    DispatchQueue.main.async {
+      if self.ensurePreviousPromiseSettled(settler: self._password_retriever, reject: reject) {
+        self._password_retriever = PasswordRetriever(resolve: resolve, reject: reject, emitEvent: self.emitEvent)
       }
+    }
   }
 
   @objc
@@ -109,8 +161,10 @@ public class OauthEssentialsModule: NSObject {
     options: NSDictionary,
     resolver resolve: @escaping RCTPromiseResolveBlock,
     rejecter reject: @escaping RCTPromiseRejectBlock) {
-    if (ensurePreviousPromiseSettled(settler: self._hybrid_retriever,reject: reject)) {
-      self._hybrid_retriever = HybridRetriever(clientId: clientId, options: options, resolve: resolve, reject: reject, emitEvent: emitEvent)
+    DispatchQueue.main.async {
+      if self.ensurePreviousPromiseSettled(settler: self._hybrid_retriever, reject: reject) {
+        self._hybrid_retriever = HybridRetriever(clientId: clientId, options: options, resolve: resolve, reject: reject, emitEvent: self.emitEvent)
+      }
     }
   }
 
@@ -119,6 +173,24 @@ public class OauthEssentialsModule: NSObject {
     _ options: NSDictionary,
     resolver resolve: @escaping RCTPromiseResolveBlock,
     rejecter reject: @escaping RCTPromiseRejectBlock
+  ) {
+    performPassKey(options: options, registration: true, resolve: resolve, reject: reject)
+  }
+
+  @objc(getPassKey:resolver:rejecter:)
+  public func getPassKey(
+    _ options: NSDictionary,
+    resolver resolve: @escaping RCTPromiseResolveBlock,
+    rejecter reject: @escaping RCTPromiseRejectBlock
+  ) {
+    performPassKey(options: options, registration: false, resolve: resolve, reject: reject)
+  }
+
+  private func performPassKey(
+    options: NSDictionary,
+    registration: Bool,
+    resolve: @escaping RCTPromiseResolveBlock,
+    reject: @escaping RCTPromiseRejectBlock
   ) {
     guard #available(iOS 16.0, *) else {
       reject(
@@ -129,69 +201,122 @@ public class OauthEssentialsModule: NSObject {
       return
     }
 
-    if ensurePreviousPromiseSettled(settler: self._passkey_retriever, reject: reject) {
-      guard let requestJson = options["requestJson"] as? String else {
-        reject(
-          CredentialError.invalidResult.rawValue,
-          "\"requestJson\" field is required",
-          nil
-        )
-        return
+    DispatchQueue.main.async {
+      // A pending AutoFill request must not block an explicit passkey request.
+      if let pending = self._passkey_retriever as? PasskeyRetriever, pending.autoFill, !pending.settled() {
+        pending.cancel()
+        pending.succeed(CredentialFactory.fromCancelled())
       }
 
-      self._passkey_retriever = PasskeyRetriever(
-        requestJson: requestJson,
-        mode: .registration,
-        resolve: resolve,
-        reject: reject,
-        emitEvent: emitEvent
-      )
+      if self.ensurePreviousPromiseSettled(settler: self._passkey_retriever, reject: reject) {
+        guard let requestJson = options["requestJson"] as? String else {
+          reject(
+            CredentialError.invalidResult.rawValue,
+            "\"requestJson\" field is required",
+            nil
+          )
+          return
+        }
+
+        self._passkey_retriever = PasskeyRetriever(
+          requestJson: requestJson,
+          mode: registration ? .registration : .assertion,
+          autoFill: (options["mediation"] as? String) == "autofill",
+          resolve: resolve,
+          reject: reject,
+          emitEvent: self.emitEvent
+        )
+      }
     }
   }
 
-  @objc(getPassKey:resolver:rejecter:)
-  public func getPassKey(
-    _ options: NSDictionary,
-    resolver resolve: @escaping RCTPromiseResolveBlock,
+  @objc
+  public func cancelPassKeyAutoFill(
+    _ resolve: @escaping RCTPromiseResolveBlock,
     rejecter reject: @escaping RCTPromiseRejectBlock
   ) {
     guard #available(iOS 16.0, *) else {
-      reject(
-        CredentialError.notSupportedError.rawValue,
-        "Passkeys require iOS 16.0 or later",
-        nil
-      )
+      resolve(false)
       return
     }
 
-    if ensurePreviousPromiseSettled(settler: self._passkey_retriever, reject: reject) {
-      guard let requestJson = options["requestJson"] as? String else {
-        reject(
-          CredentialError.invalidResult.rawValue,
-          "\"requestJson\" field is required",
-          nil
-        )
+    DispatchQueue.main.async {
+      guard let pending = self._passkey_retriever as? PasskeyRetriever, pending.autoFill, !pending.settled() else {
+        resolve(false)
         return
       }
-
-      self._passkey_retriever = PasskeyRetriever(
-        requestJson: requestJson,
-        mode: .assertion,
-        resolve: resolve,
-        reject: reject,
-        emitEvent: emitEvent
-      )
+      pending.cancel()
+      pending.succeed(CredentialFactory.fromCancelled())
+      resolve(true)
     }
   }
 
-  @objc(appleSignIn:resolver:rejecter:)
+  @objc(appleSignIn:options:resolver:rejecter:)
   public func appleSignIn(
-    _ webAndroidUrl: String,
+    _ webAndroidUrl: String?,
+    options: NSDictionary,
     resolver resolve: @escaping RCTPromiseResolveBlock,
     rejecter reject: @escaping RCTPromiseRejectBlock
   ) {
-    if (ensurePreviousPromiseSettled(settler: self._apple_id_retriever,reject: reject)) {
-      self._apple_id_retriever = AppleIdRetriever(resolve: resolve,reject: reject,  emitEvent: emitEvent)
+    DispatchQueue.main.async {
+      if self.ensurePreviousPromiseSettled(settler: self._apple_id_retriever, reject: reject) {
+        self._apple_id_retriever = AppleIdRetriever(options: options, resolve: resolve, reject: reject, emitEvent: self.emitEvent)
+      }
+    }
+  }
+
+  @objc(getAppleIdCredentialState:resolver:rejecter:)
+  public func getAppleIdCredentialState(
+    _ userId: String,
+    resolver resolve: @escaping RCTPromiseResolveBlock,
+    rejecter reject: @escaping RCTPromiseRejectBlock
+  ) {
+    ASAuthorizationAppleIDProvider().getCredentialState(forUserID: userId) { state, error in
+      if let error = error {
+        reject(CredentialError.invalidResult.rawValue, error.localizedDescription, error)
+        return
+      }
+      switch state {
+      case .authorized:
+        resolve("AUTHORIZED")
+      case .revoked:
+        resolve("REVOKED")
+      case .transferred:
+        resolve("TRANSFERRED")
+      default:
+        resolve("NOT_FOUND")
+      }
+    }
+  }
+
+  @objc
+  public func generatePkce(
+    _ resolve: @escaping RCTPromiseResolveBlock,
+    rejecter reject: @escaping RCTPromiseRejectBlock
+  ) {
+    guard let codeVerifier = Pkce.randomString(byteCount: 32),
+          let state = Pkce.randomString(byteCount: 16) else {
+      reject(CredentialError.invalidResult.rawValue, "Unable to generate random bytes", nil)
+      return
+    }
+    resolve([
+      "codeVerifier": codeVerifier,
+      "codeChallenge": Pkce.challenge(for: codeVerifier),
+      "state": state
+    ])
+  }
+
+  @objc(openAuthSession:options:resolver:rejecter:)
+  public func openAuthSession(
+    _ url: String,
+    options: NSDictionary,
+    resolver resolve: @escaping RCTPromiseResolveBlock,
+    rejecter reject: @escaping RCTPromiseRejectBlock
+  ) {
+    DispatchQueue.main.async {
+      if self.ensurePreviousPromiseSettled(settler: self._auth_session_retriever, reject: reject) {
+        self._auth_session_retriever = AuthSessionRetriever(url: url, options: options, resolve: resolve, reject: reject)
+      }
     }
   }
 
@@ -208,3 +333,87 @@ public class OauthEssentialsModule: NSObject {
     }
   }
 }
+
+enum Pkce {
+  static func randomString(byteCount: Int) -> String? {
+    var bytes = [UInt8](repeating: 0, count: byteCount)
+    guard SecRandomCopyBytes(kSecRandomDefault, byteCount, &bytes) == errSecSuccess else {
+      return nil
+    }
+    return Data(bytes).base64URLEncodedString()
+  }
+
+  static func challenge(for verifier: String) -> String {
+    return Data(SHA256.hash(data: Data(verifier.utf8))).base64URLEncodedString()
+  }
+}
+
+/// Opens an url in ASWebAuthenticationSession and resolves with the redirect url.
+/// It does not emit events: oauthSignIn finishes the flow in JS.
+public class AuthSessionRetriever: RCTPromiseSettler, ASWebAuthenticationPresentationContextProviding {
+
+  private var session: ASWebAuthenticationSession?
+
+  init(
+    url: String,
+    options: NSDictionary,
+    resolve: @escaping RCTPromiseResolveBlock,
+    reject: @escaping RCTPromiseRejectBlock
+  ) {
+    super.init(resolve: resolve, reject: reject, emitEvent: nil)
+
+    guard let authUrl = URL(string: url),
+          let callbackScheme = options["callbackScheme"] as? String else {
+      fail(.invalidResult, "Invalid authorization url or redirect uri")
+      return
+    }
+    whenBrowserCanOpen("oauthSignIn") { _ in
+      let session = ASWebAuthenticationSession(url: authUrl, callbackURLScheme: callbackScheme) { callbackURL, error in
+        self.session = nil
+        self.handle(callbackURL: callbackURL, error: error)
+      }
+      session.presentationContextProvider = self
+      session.prefersEphemeralWebBrowserSession = (options["prefersEphemeralSession"] as? Bool) ?? false
+      self.session = session
+
+      if !session.start() {
+        self.session = nil
+        self.fail(.browserUnavailable, "Unable to start the browser session")
+      }
+    }
+  }
+
+  private func handle(callbackURL: URL?, error: Error?) {
+    if let error = error {
+      let nsError = error as NSError
+      if nsError.domain == ASWebAuthenticationSessionError.errorDomain {
+        switch nsError.code {
+        case ASWebAuthenticationSessionError.canceledLogin.rawValue:
+          succeed(CredentialFactory.fromCancelled())
+          return
+        case ASWebAuthenticationSessionError.presentationContextNotProvided.rawValue,
+             ASWebAuthenticationSessionError.presentationContextInvalid.rawValue:
+          fail(.browserUnavailable, error.localizedDescription, error)
+          return
+        default:
+          break
+        }
+      }
+      fail(.invalidResult, error.localizedDescription, error)
+      return
+    }
+
+    guard let callbackURL = callbackURL else {
+      fail(.invalidResult, "No redirect url returned")
+      return
+    }
+    succeed([
+      "type": CredentialsType.redirect.rawValue,
+      "data": ["url": callbackURL.absoluteString]
+    ])
+  }
+
+  public func presentationAnchor(for session: ASWebAuthenticationSession) -> ASPresentationAnchor {
+    return PresentationContext.anchor()
+  }
+}

package/ios/PasskeyRetriever.swift

@@ -20,15 +20,20 @@ public class PasskeyRetriever: RCTPromiseSettler,
   }
 
   private let mode: Mode
+  /// AutoFill requests wait for the user to pick a passkey in the QuickType bar.
+  let autoFill: Bool
+  private var controller: ASAuthorizationController?
 
   init(
     requestJson: String,
     mode: Mode,
+    autoFill: Bool,
     resolve: @escaping RCTPromiseResolveBlock,
     reject: @escaping RCTPromiseRejectBlock,
     emitEvent: ((String, NSDictionary) -> Void)?
   ) {
     self.mode = mode
+    self.autoFill = autoFill && mode == .assertion
     super.init(resolve: resolve, reject: reject, emitEvent: emitEvent)
 
     do {
@@ -36,17 +41,22 @@ public class PasskeyRetriever: RCTPromiseSettler,
       let controller = ASAuthorizationController(authorizationRequests: [request])
       controller.delegate = self
       controller.presentationContextProvider = self
-      controller.performRequests(options: .preferImmediatelyAvailableCredentials)
+      self.controller = controller
+      if self.autoFill {
+        controller.performAutoFillAssistedRequests()
+      } else {
+        controller.performRequests(options: .preferImmediatelyAvailableCredentials)
+      }
     } catch {
-      reject(
-        CredentialError.invalidResult.rawValue,
-        "Failed to parse requestJson: \(error.localizedDescription)",
-        error
-      )
-      cleanup()
+      fail(.invalidResult, "Failed to parse requestJson: \(error.localizedDescription)", error)
     }
   }
 
+  /// Cancels the pending request, which resolves it as cancelled.
+  func cancel() {
+    controller?.cancel()
+  }
+
   private func buildRequest(requestJson: String, mode: Mode) throws -> ASAuthorizationRequest {
     guard let data = requestJson.data(using: .utf8),
           let json = try JSONSerialization.jsonObject(with: data) as? [String: Any] else {
@@ -65,7 +75,7 @@ public class PasskeyRetriever: RCTPromiseSettler,
 
   private func buildRegistrationRequest(json: [String: Any]) throws -> ASAuthorizationRequest {
     guard let challengeStr = json["challenge"] as? String,
-          let challenge = base64URLDecode(challengeStr) else {
+          let challenge = Data(base64URLEncoded: challengeStr) else {
       throw NSError(domain: "PasskeyRetriever", code: -1, userInfo: [
         NSLocalizedDescriptionKey: "Missing or invalid challenge"
       ])
@@ -80,7 +90,7 @@ public class PasskeyRetriever: RCTPromiseSettler,
 
     guard let user = json["user"] as? [String: Any],
           let userIdStr = user["id"] as? String,
-          let userId = base64URLDecode(userIdStr),
+          let userId = Data(base64URLEncoded: userIdStr),
           let userName = user["name"] as? String else {
       throw NSError(domain: "PasskeyRetriever", code: -1, userInfo: [
         NSLocalizedDescriptionKey: "Missing or invalid user fields"
@@ -107,7 +117,7 @@ public class PasskeyRetriever: RCTPromiseSettler,
         if #available(iOS 17.4, *) {
             request.excludedCredentials = excludeCredentials.compactMap { cred in
                 guard let idStr = cred["id"] as? String,
-                      let idData = base64URLDecode(idStr) else { return nil }
+                      let idData = Data(base64URLEncoded: idStr) else { return nil }
                 return ASAuthorizationPlatformPublicKeyCredentialDescriptor(credentialID: idData)
             }
         } else {
@@ -120,7 +130,7 @@ public class PasskeyRetriever: RCTPromiseSettler,
 
   private func buildAssertionRequest(json: [String: Any]) throws -> ASAuthorizationRequest {
     guard let challengeStr = json["challenge"] as? String,
-          let challenge = base64URLDecode(challengeStr) else {
+          let challenge = Data(base64URLEncoded: challengeStr) else {
       throw NSError(domain: "PasskeyRetriever", code: -1, userInfo: [
         NSLocalizedDescriptionKey: "Missing or invalid challenge"
       ])
@@ -134,7 +144,7 @@ public class PasskeyRetriever: RCTPromiseSettler,
     if let allowCredentials = json["allowCredentials"] as? [[String: Any]] {
       request.allowedCredentials = allowCredentials.compactMap { cred in
         guard let idStr = cred["id"] as? String,
-              let idData = base64URLDecode(idStr) else { return nil }
+              let idData = Data(base64URLEncoded: idStr) else { return nil }
         return ASAuthorizationPlatformPublicKeyCredentialDescriptor(credentialID: idData)
       }
     }
@@ -152,66 +162,38 @@ public class PasskeyRetriever: RCTPromiseSettler,
     controller: ASAuthorizationController,
     didCompleteWithAuthorization authorization: ASAuthorization
   ) {
+    self.controller = nil
     switch mode {
     case .registration:
       if let credential = authorization.credential as? ASAuthorizationPlatformPublicKeyCredentialRegistration {
-        let result = CredentialFactory.fromPasskeyRegistration(credential: credential)
-        self.resolve?(result)
-        self.emitEvent?("onCredentialSuccess", result as NSDictionary)
+        succeed(CredentialFactory.fromPasskeyRegistration(credential: credential))
+        return
       }
     case .assertion:
       if let credential = authorization.credential as? ASAuthorizationPlatformPublicKeyCredentialAssertion {
-        let result = CredentialFactory.fromPasskeyAssertion(credential: credential)
-        self.resolve?(result)
-        self.emitEvent?("onCredentialSuccess", result as NSDictionary)
+        succeed(CredentialFactory.fromPasskeyAssertion(credential: credential))
+        return
       }
     }
-    cleanup()
+    fail(.invalidResult, "Unexpected credential type")
   }
 
   public func authorizationController(
     controller: ASAuthorizationController,
     didCompleteWithError error: Error
   ) {
-    let nsError = error as NSError
-    if nsError.domain == ASAuthorizationError.errorDomain,
-       nsError.code == ASAuthorizationError.canceled.rawValue {
-      let result = CredentialFactory.fromCancelled()
-      self.resolve?(result)
-      self.emitEvent?("onCredentialSuccess", result as NSDictionary)
-    } else {
-      self.reject?(
-        CredentialError.invalidResult.rawValue,
-        error.localizedDescription,
-        error
-      )
-      self.emitEvent?("onCredentialFailure", [
-        "code": CredentialError.invalidResult.rawValue,
-        "message": error.localizedDescription
-      ])
-    }
-    cleanup()
+    self.controller = nil
+    finish(authorizationError: error)
   }
 
   // MARK: - ASAuthorizationControllerPresentationContextProviding
 
   public func presentationAnchor(for controller: ASAuthorizationController) -> ASPresentationAnchor {
-    return UIWindow()
+    return PresentationContext.anchor()
   }
 
   // MARK: - Helpers
 
-  private func base64URLDecode(_ string: String) -> Data? {
-    var base64 = string
-      .replacingOccurrences(of: "-", with: "+")
-      .replacingOccurrences(of: "_", with: "/")
-    let remainder = base64.count % 4
-    if remainder > 0 {
-      base64.append(String(repeating: "=", count: 4 - remainder))
-    }
-    return Data(base64Encoded: base64)
-  }
-
   private func mapUserVerification(_ value: String) -> ASAuthorizationPublicKeyCredentialUserVerificationPreference {
     switch value {
     case "required":

package/ios/PasswordRetriever.swift

@@ -5,6 +5,8 @@ public class PasswordRetriever: RCTPromiseSettler,
   ASAuthorizationControllerDelegate,
   ASAuthorizationControllerPresentationContextProviding {
 
+  private var controller: ASAuthorizationController?
+
   override init(
     resolve: @escaping RCTPromiseResolveBlock,
     reject: @escaping RCTPromiseRejectBlock,
@@ -16,6 +18,7 @@ public class PasswordRetriever: RCTPromiseSettler,
     let controller = ASAuthorizationController(authorizationRequests: [request])
     controller.delegate = self
     controller.presentationContextProvider = self
+    self.controller = controller
     if #available(iOS 16.0, *) {
       controller.performRequests(options: .preferImmediatelyAvailableCredentials)
     } else {
@@ -27,12 +30,11 @@ public class PasswordRetriever: RCTPromiseSettler,
     controller: ASAuthorizationController,
     didCompleteWithAuthorization authorization: ASAuthorization
   ) {
+    self.controller = nil
     if let credential = authorization.credential as? ASPasswordCredential {
-      let result = CredentialFactory.fromPassword(credential:  credential)
-      self.resolve?(result)
-      self.emitEvent?("onCredentialSuccess", result as NSDictionary)
-
-      cleanup()
+      succeed(CredentialFactory.fromPassword(credential: credential))
+    } else {
+      fail(.invalidResult, "Unexpected credential type")
     }
   }
 
@@ -40,33 +42,11 @@ public class PasswordRetriever: RCTPromiseSettler,
     controller: ASAuthorizationController,
     didCompleteWithError error: Error
   ) {
-    let nsError = error as NSError
-    if nsError.domain == ASAuthorizationError.errorDomain,
-       nsError.code == ASAuthorizationError.canceled.rawValue {
-    
-      let result = CredentialFactory.fromCancelled()
-      self.resolve?(result)
-      self.emitEvent?("onCredentialSuccess", result as NSDictionary)
-    } else {
-      self.reject?(
-        CredentialError.invalidResult.rawValue,
-        error.localizedDescription,
-        error
-      )
-      self.emitEvent?("onCredentialFailure", [
-        "code": CredentialError.invalidResult.rawValue,
-        "message": error.localizedDescription
-      ])
-    }
-
-    self.cleanup()
+    self.controller = nil
+    finish(authorizationError: error)
   }
 
   public func presentationAnchor(for controller: ASAuthorizationController) -> ASPresentationAnchor {
-    return UIWindow()
-  }
-
-  func getIsSettled() -> Bool {
-    return resolve == nil || reject == nil
+    return PresentationContext.anchor()
   }
 }