react-native-oauth-essentials 1.0.12 → 1.2.0

package/app.plugin.js

@@ -0,0 +1 @@
+module.exports = require('./plugin/withOauthEssentials');

package/ios/AppleIdRetriever.swift

@@ -5,7 +5,10 @@ public class AppleIdRetriever: RCTPromiseSettler,
   ASAuthorizationControllerDelegate,
   ASAuthorizationControllerPresentationContextProviding  {
 
-  override init(
+  private var controller: ASAuthorizationController?
+
+  init(
+    options: NSDictionary,
     resolve: @escaping RCTPromiseResolveBlock,
     reject: @escaping RCTPromiseRejectBlock,
     emitEvent: ((String, NSDictionary) -> Void)?
@@ -13,49 +16,45 @@ public class AppleIdRetriever: RCTPromiseSettler,
     super.init(resolve: resolve, reject: reject, emitEvent: emitEvent)
 
     let controller = ASAuthorizationController(authorizationRequests: [
-      ASAuthorizationAppleIDProvider().createRequest(),
+      AppleIdRetriever.createRequest(options: options),
     ])
-
     controller.delegate = self
     controller.presentationContextProvider = self
+    self.controller = controller
+    controller.performRequests()
+  }
 
-    if #available(iOS 16.0, *) {
-      controller.performRequests(options: .preferImmediatelyAvailableCredentials)
-    } else {
-      controller.performRequests()
+  /// Apple only returns the email and full name on the first sign in, and only when requested.
+  static func createRequest(options: NSDictionary?) -> ASAuthorizationAppleIDRequest {
+    let request = ASAuthorizationAppleIDProvider().createRequest()
+    request.requestedScopes = [.fullName, .email]
+    if let nonce = options?["nonce"] as? String {
+      request.nonce = nonce
     }
+    if let state = options?["state"] as? String {
+      request.state = state
+    }
+    return request
   }
 
   public func presentationAnchor(for controller: ASAuthorizationController) -> ASPresentationAnchor {
-    return UIWindow()
+    return PresentationContext.anchor()
   }
 
   public func authorizationController(
     controller: ASAuthorizationController,
     didCompleteWithAuthorization authorization: ASAuthorization
   ) {
+    self.controller = nil
     if let appleIdCredential = authorization.credential as? ASAuthorizationAppleIDCredential {
-      let result = CredentialFactory.fromAppleId(appleIdCredential: appleIdCredential)
-      self.resolve?(result)
-      self.emitEvent?("onCredentialSuccess", result as NSDictionary)
-      cleanup()
+      succeed(CredentialFactory.fromAppleId(appleIdCredential: appleIdCredential))
+    } else {
+      fail(.invalidResult, "Unexpected credential type")
     }
   }
 
   public func authorizationController(controller: ASAuthorizationController, didCompleteWithError error: Error) {
-    let nsError = error as NSError
-    if nsError.domain == ASAuthorizationError.errorDomain,
-       nsError.code == ASAuthorizationError.canceled.rawValue {
-      
-      let result = CredentialFactory.fromCancelled()
-      self.resolve?(result)
-      self.emitEvent?("onCredentialSuccess", result as NSDictionary)
-    } else {
-      self.emitEvent?("onCredentialFailure", [
-        "code": CredentialError.invalidResult.rawValue,
-        "message": error.localizedDescription
-      ])
-    }
-    cleanup()
+    self.controller = nil
+    finish(authorizationError: error)
   }
 }

package/ios/CredentialError.swift

@@ -3,4 +3,7 @@ public enum CredentialError: String {
   case invalidResult = "INVALID_RESULT_ERROR"
   case simultaneousCallError = "SIMULTANEOUS_CALL_ERROR"
   case notSupportedError = "NOT_SUPPORTED_ERROR"
+  case browserUnavailable = "BROWSER_UNAVAILABLE"
+  case noActivity = "NO_ACTIVITY_ERROR"
+  case configuration = "CONFIGURATION_ERROR"
 }

package/ios/CredentialFactory.swift

@@ -29,7 +29,8 @@ class CredentialFactory {
           "user": appleIdCredential.user,
           "email": appleIdCredential.email ?? "",
           "fullName": fullName,
-          "likelyReal": appleIdCredential.realUserStatus == .likelyReal
+          "likelyReal": appleIdCredential.realUserStatus == .likelyReal,
+          "state": appleIdCredential.state ?? NSNull()
         ]
 
         let result: [String: Any] = [
@@ -54,12 +55,12 @@ class CredentialFactory {
     @available(iOS 16.0, *)
     public static func fromPasskeyRegistration(credential: ASAuthorizationPlatformPublicKeyCredentialRegistration) -> [String: Any] {
         let responseJson: [String: Any] = [
-          "id": base64URLEncode(credential.credentialID),
-          "rawId": base64URLEncode(credential.credentialID),
+          "id": credential.credentialID.base64URLEncodedString(),
+          "rawId": credential.credentialID.base64URLEncodedString(),
           "type": "public-key",
           "response": [
-            "clientDataJSON": base64URLEncode(credential.rawClientDataJSON),
-            "attestationObject": base64URLEncode(credential.rawAttestationObject ?? Data())
+            "clientDataJSON": credential.rawClientDataJSON.base64URLEncodedString(),
+            "attestationObject": (credential.rawAttestationObject ?? Data()).base64URLEncodedString()
           ]
         ]
 
@@ -80,14 +81,14 @@ class CredentialFactory {
     @available(iOS 16.0, *)
     public static func fromPasskeyAssertion(credential: ASAuthorizationPlatformPublicKeyCredentialAssertion) -> [String: Any] {
         let responseJson: [String: Any] = [
-          "id": base64URLEncode(credential.credentialID),
-          "rawId": base64URLEncode(credential.credentialID),
+          "id": credential.credentialID.base64URLEncodedString(),
+          "rawId": credential.credentialID.base64URLEncodedString(),
           "type": "public-key",
           "response": [
-            "clientDataJSON": base64URLEncode(credential.rawClientDataJSON),
-            "authenticatorData": base64URLEncode(credential.rawAuthenticatorData),
-            "signature": base64URLEncode(credential.signature),
-            "userHandle": base64URLEncode(credential.userID)
+            "clientDataJSON": credential.rawClientDataJSON.base64URLEncodedString(),
+            "authenticatorData": credential.rawAuthenticatorData.base64URLEncodedString(),
+            "signature": credential.signature.base64URLEncodedString(),
+            "userHandle": credential.userID.base64URLEncodedString()
           ]
         ]
 
@@ -105,14 +106,7 @@ class CredentialFactory {
         ]
     }
 
-    private static func base64URLEncode(_ data: Data) -> String {
-        return data.base64EncodedString()
-            .replacingOccurrences(of: "+", with: "-")
-            .replacingOccurrences(of: "/", with: "_")
-            .replacingOccurrences(of: "=", with: "")
-    }
-
-    public static func fromGoogleId(user: GIDGoogleUser) -> [String: Any] {
+    public static func fromGoogleId(user: GIDGoogleUser, serverAuthCode: String?) -> [String: Any] {
         let profile = user.profile
         let data: [String: Any] = [
           "idToken": user.idToken?.tokenString ?? "",
@@ -121,7 +115,10 @@ class CredentialFactory {
           "givenName": profile?.givenName ?? "",
           "familyName": profile?.familyName ?? "",
           "profilePictureUri": profile?.imageURL(withDimension: 200)?.absoluteString ?? "",
-          "email": profile?.email ?? ""
+          "email": profile?.email ?? "",
+          "accessToken": user.accessToken.tokenString,
+          "serverAuthCode": serverAuthCode ?? NSNull(),
+          "grantedScopes": user.grantedScopes ?? []
         ]
 
         let result: [String: Any] = [
@@ -131,3 +128,24 @@ class CredentialFactory {
         return result
     }
 }
+
+/// base64url without padding (RFC 4648 §5), used by WebAuthn and PKCE.
+extension Data {
+    func base64URLEncodedString() -> String {
+        return base64EncodedString()
+            .replacingOccurrences(of: "+", with: "-")
+            .replacingOccurrences(of: "/", with: "_")
+            .replacingOccurrences(of: "=", with: "")
+    }
+
+    init?(base64URLEncoded string: String) {
+        var base64 = string
+            .replacingOccurrences(of: "-", with: "+")
+            .replacingOccurrences(of: "_", with: "/")
+        let remainder = base64.count % 4
+        if remainder > 0 {
+            base64.append(String(repeating: "=", count: 4 - remainder))
+        }
+        self.init(base64Encoded: base64)
+    }
+}

package/ios/CredentialsType.swift

@@ -4,4 +4,5 @@ public enum CredentialsType: String {
   case appleId = "APPLE_ID"
   case cancelled = "CANCELLED"
   case passkey = "PASSKEY"
+  case redirect = "REDIRECT"
 }

package/ios/GoogleIdRetriever.swift

@@ -1,83 +1,159 @@
 import GoogleSignIn
 import React
 
+/// Must be created on the main thread: GIDSignIn presents ASWebAuthenticationSession synchronously.
 public class GoogleIdRetriever: RCTPromiseSettler {
 
   init(
     clientId: String,
     options: NSDictionary,
+    silent: Bool,
     resolve: @escaping RCTPromiseResolveBlock,
     reject: @escaping RCTPromiseRejectBlock,
     emitEvent: ((String, NSDictionary) -> Void)?
   ) {
     super.init(resolve: resolve, reject: reject, emitEvent: emitEvent)
-    performGoogleSignIn(clientId:clientId, options: options)
-  }
 
-  private func performGoogleSignIn(clientId: String, options: NSDictionary) {
-    var rootVC: UIViewController?
-    DispatchQueue.main.sync {
-        if #available(iOS 13.0, *) {
-            rootVC = UIApplication.shared.connectedScenes
-                .compactMap { $0 as? UIWindowScene }
-                .flatMap { $0.windows }
-                .first { $0.isKeyWindow }?
-                .rootViewController
-        } else {
-            rootVC = UIApplication.shared.keyWindow?.rootViewController
-        }
+    // GIDSignIn raises an NSException (crashing the app) for a missing client id or, in the
+    // interactive flow only, URL scheme, so they are validated here and reported as
+    // CONFIGURATION_ERROR instead.
+    guard let clientId = Self.resolveClientId(clientId) else {
+      fail(
+        .configuration,
+        "Missing Google iOS client id: pass { iosClientId }, set GIDClientID in Info.plist (the Expo "
+          + "plugin does it) or add the Firebase GoogleService-Info.plist to the app target"
+      )
+      return
     }
-
-    guard let rootVC = rootVC else {
-      self.reject?(
-        CredentialError.noSignInAvailable.rawValue,
-        "No root view controller available",
-        nil
+    let scheme = Self.urlScheme(for: clientId)
+    guard silent || Self.registeredUrlSchemes().contains(scheme) else {
+      fail(
+        .configuration,
+        "Info.plist is missing the URL scheme \"\(scheme)\" required by Google Sign-In. Add it to "
+          + "CFBundleURLTypes > CFBundleURLSchemes (it is REVERSED_CLIENT_ID in GoogleService-Info.plist; "
+          + "the Expo config plugin adds it). "
+          + "\(clientId) must be the iOS client id; web client ids go in serverClientId."
       )
-      self.emitEvent?("onCredentialFailure", [
-        "code": CredentialError.noSignInAvailable.rawValue,
-        "message": "No root view controller available"
-      ])
+      return
+    }
+
+    GIDSignIn.sharedInstance.configuration = GIDConfiguration(
+      clientID: clientId,
+      serverClientID: options["serverClientId"] as? String ?? Self.infoPlistString("GIDServerClientID"),
+      hostedDomain: options["hostedDomain"] as? String,
+      openIDRealm: nil
+    )
+
+    if silent {
+      restorePreviousSignIn()
+    } else {
+      performGoogleSignIn(options: options)
+    }
+  }
 
-      self.cleanup()
+  private func performGoogleSignIn(options: NSDictionary) {
+    whenBrowserCanOpen("Google Sign-In") { presenter in
+      GIDSignIn.sharedInstance.signIn(
+        withPresenting: presenter,
+        hint: options["hint"] as? String,
+        additionalScopes: options["scopes"] as? [String],
+        nonce: options["nonce"] as? String
+      ) { result, error in
+        self.handle(user: result?.user, serverAuthCode: result?.serverAuthCode, error: error)
+      }
+    }
+  }
+
+  private func restorePreviousSignIn() {
+    guard GIDSignIn.sharedInstance.hasPreviousSignIn() else {
+      fail(.noSignInAvailable, "No previous Google sign in to restore")
       return
     }
 
-    GIDSignIn.sharedInstance.configuration = GIDConfiguration(clientID: clientId)
-    GIDSignIn.sharedInstance.signIn(withPresenting: rootVC) { result, error in
-      
-      if let error = error {
-        let nsError = error as NSError
-        if nsError.code == GIDSignInError.canceled.rawValue {
-          let result = CredentialFactory.fromCancelled()
-          self.resolve?(result)
-          self.emitEvent?("onCredentialSuccess", result as NSDictionary)
-        } else {
-          self.reject?(CredentialError.invalidResult.rawValue, error.localizedDescription, error)
-          self.emitEvent?("onCredentialFailure", [
-            "code": CredentialError.invalidResult.rawValue,
-            "message": error.localizedDescription
-          ])
-        }
-        self.cleanup()
+    GIDSignIn.sharedInstance.restorePreviousSignIn { user, error in
+      if let error = error as NSError?,
+         error.domain == kGIDSignInErrorDomain,
+         error.code == GIDSignInError.hasNoAuthInKeychain.rawValue {
+        self.fail(.noSignInAvailable, "No previous Google sign in to restore", error)
         return
       }
-      
-      guard let user = result?.user else {
-          self.reject?(CredentialError.invalidResult.rawValue, "No user returned", nil)
-          self.emitEvent?("onCredentialFailure", [
-            "code": CredentialError.invalidResult.rawValue,
-            "message": "No user returned"
-          ])
-          
-          self.cleanup()
-          return
+      self.handle(user: user, serverAuthCode: nil, error: error)
+    }
+  }
+
+  private func handle(user: GIDGoogleUser?, serverAuthCode: String?, error: Error?) {
+    if let error = error {
+      let nsError = error as NSError
+      if nsError.domain == kGIDSignInErrorDomain,
+         nsError.code == GIDSignInError.canceled.rawValue {
+        succeed(CredentialFactory.fromCancelled())
+      } else if Self.isBrowserUnavailable(nsError) {
+        fail(.browserUnavailable, error.localizedDescription, error)
+      } else {
+        fail(.invalidResult, error.localizedDescription, error)
       }
+      return
+    }
+
+    guard let user = user else {
+      fail(.invalidResult, "No user returned")
+      return
+    }
+
+    succeed(CredentialFactory.fromGoogleId(user: user, serverAuthCode: serverAuthCode))
+  }
+
+  /// The client id passed from JS or, when it is empty, GIDClientID from Info.plist, then CLIENT_ID
+  /// from the Firebase GoogleService-Info.plist.
+  private static func resolveClientId(_ clientId: String) -> String? {
+    let trimmed = clientId.trimmingCharacters(in: .whitespacesAndNewlines)
+    if !trimmed.isEmpty {
+      return trimmed
+    }
+    return infoPlistString("GIDClientID") ?? googleServiceInfoString("CLIENT_ID")
+  }
+
+  private static func infoPlistString(_ key: String) -> String? {
+    return nonEmpty(Bundle.main.object(forInfoDictionaryKey: key) as? String)
+  }
+
+  private static func googleServiceInfoString(_ key: String) -> String? {
+    guard let path = Bundle.main.path(forResource: "GoogleService-Info", ofType: "plist"),
+          let values = NSDictionary(contentsOfFile: path) else {
+      return nil
+    }
+    return nonEmpty(values[key] as? String)
+  }
+
+  private static func nonEmpty(_ value: String?) -> String? {
+    guard let value = value?.trimmingCharacters(in: .whitespacesAndNewlines), !value.isEmpty else {
+      return nil
+    }
+    return value
+  }
+
+  /// Same rule as GIDSignInCallbackSchemes: the reversed client id, lowercased.
+  private static func urlScheme(for clientId: String) -> String {
+    return clientId.split(separator: ".").reversed().joined(separator: ".").lowercased()
+  }
+
+  private static func registeredUrlSchemes() -> Set<String> {
+    let urlTypes = Bundle.main.object(forInfoDictionaryKey: "CFBundleURLTypes") as? [[String: Any]] ?? []
+    let schemes = urlTypes.flatMap { $0["CFBundleURLSchemes"] as? [String] ?? [] }
+    return Set(schemes.map { $0.lowercased() })
+  }
 
-      let result = CredentialFactory.fromGoogleId(user: user)
-      self.resolve?(result)
-      self.emitEvent?("onCredentialSuccess", result as NSDictionary)
-      self.cleanup()
+  /// Fallback for the causes `whenBrowserCanOpen` does not catch. GIDSignIn reports a failed
+  /// ASWebAuthenticationSession start as an unknown error that only keeps AppAuth's (not localized)
+  /// "Unable to open Safari." message (OIDErrorCodeSafariOpenError = -9).
+  private static func isBrowserUnavailable(_ error: NSError) -> Bool {
+    if let underlying = error.userInfo[NSUnderlyingErrorKey] as? NSError,
+       underlying.domain == "org.openid.appauth.general",
+       underlying.code == -9 {
+      return true
     }
+    return error.domain == kGIDSignInErrorDomain
+      && error.code == GIDSignInError.unknown.rawValue
+      && error.localizedDescription.contains("Unable to open Safari")
   }
 }

package/ios/HybridRetriever.swift

@@ -5,6 +5,8 @@ public class HybridRetriever: RCTPromiseSettler,
 ASAuthorizationControllerDelegate,
 ASAuthorizationControllerPresentationContextProviding  {
 
+  private var controller: ASAuthorizationController?
+
   init(
     clientId: String,
     options: NSDictionary,
@@ -15,12 +17,13 @@ ASAuthorizationControllerPresentationContextProviding  {
     super.init(resolve: resolve, reject: reject, emitEvent: emitEvent)
 
     let controller = ASAuthorizationController(authorizationRequests: [
-      ASAuthorizationAppleIDProvider().createRequest(),
+      AppleIdRetriever.createRequest(options: options),
       ASAuthorizationPasswordProvider().createRequest()
     ])
 
     controller.delegate = self
     controller.presentationContextProvider = self
+    self.controller = controller
 
     if #available(iOS 16.0, *) {
       controller.performRequests(options: .preferImmediatelyAvailableCredentials)
@@ -30,35 +33,26 @@ ASAuthorizationControllerPresentationContextProviding  {
   }
 
   public func presentationAnchor(for controller: ASAuthorizationController) -> ASPresentationAnchor {
-    return UIWindow()
+    return PresentationContext.anchor()
   }
 
   public func authorizationController(
     controller: ASAuthorizationController,
     didCompleteWithAuthorization authorization: ASAuthorization
   ) {
+    self.controller = nil
     if let appleIdCredential = authorization.credential as? ASAuthorizationAppleIDCredential {
-      let result = CredentialFactory.fromAppleId(appleIdCredential: appleIdCredential)
-      self.resolve?(result)
-      self.emitEvent?("onCredentialSuccess", result as NSDictionary)
+      succeed(CredentialFactory.fromAppleId(appleIdCredential: appleIdCredential))
     }
     else if let credential = authorization.credential as? ASPasswordCredential {
-      let result = CredentialFactory.fromPassword(credential: credential)
-      self.resolve?(result)
-      self.emitEvent?("onCredentialSuccess", result as NSDictionary)
+      succeed(CredentialFactory.fromPassword(credential: credential))
+    } else {
+      fail(.invalidResult, "Unexpected credential type")
     }
-    cleanup()
   }
 
   public func authorizationController(controller: ASAuthorizationController, didCompleteWithError error: Error) {
-    self.reject?(
-      CredentialError.invalidResult.rawValue,
-      error.localizedDescription,
-      error
-    )
-    self.emitEvent?("onCredentialFailure", [
-      "code": CredentialError.invalidResult.rawValue,
-      "message": error.localizedDescription
-    ])
+    self.controller = nil
+    finish(authorizationError: error)
   }
 }

package/ios/OauthEssentials.h

@@ -2,7 +2,4 @@
 
 @interface OauthEssentials : NativeOauthEssentialsSpecBase <NativeOauthEssentialsSpec>
 
-- (void)emitOnCredentialSuccess:(NSDictionary *)value;
-- (void)emitOnCredentialFailure:(NSDictionary *)value;
-
 @end

package/ios/OauthEssentials.mm

@@ -17,7 +17,9 @@
                 initOnCredentialSuccess:^(NSDictionary * _Nonnull value) {
       [weakSelf emitOnCredentialSuccess:value];
     } onCredentialFailure:^(NSDictionary * _Nonnull value) {
-      [weakSelf emitOnCredentialSuccess:value];
+      [weakSelf emitOnCredentialFailure:value];
+    } onAppleIdCredentialRevoked:^(NSDictionary * _Nonnull value) {
+      [weakSelf emitOnAppleIdCredentialRevoked:value];
     }];
   }
   return self;
@@ -52,6 +54,23 @@
                  rejecter:reject];
 }
 
+- (void)googleSilentSignIn:(NSString *)clientId
+                   options:(NSDictionary *)options
+                   resolve:(RCTPromiseResolveBlock)resolve
+                    reject:(RCTPromiseRejectBlock)reject
+{
+  [_sModule googleSilentSignIn:clientId
+                       options:options
+                      resolver:resolve
+                      rejecter:reject];
+}
+
+- (void)signOut:(RCTPromiseResolveBlock)resolve
+         reject:(RCTPromiseRejectBlock)reject
+{
+  [_sModule signOut:resolve rejecter:reject];
+}
+
 - (void)passwordSignIn:(NSString *)username
               password:(NSString *)password
                resolve:(RCTPromiseResolveBlock)resolve
@@ -80,9 +99,16 @@
 }
 
 - (void)appleSignIn:(NSString *)webAndroidUrl
+            options:(NSDictionary *)options
             resolve:(RCTPromiseResolveBlock)resolve
             reject:(RCTPromiseRejectBlock)reject {
-    [_sModule appleSignIn:webAndroidUrl resolver:resolve rejecter:reject];
+    [_sModule appleSignIn:webAndroidUrl options:options resolver:resolve rejecter:reject];
+}
+
+- (void)getAppleIdCredentialState:(NSString *)userId
+                          resolve:(RCTPromiseResolveBlock)resolve
+                           reject:(RCTPromiseRejectBlock)reject {
+    [_sModule getAppleIdCredentialState:userId resolver:resolve rejecter:reject];
 }
 
 - (void)createPassKey:(NSDictionary *)options
@@ -97,6 +123,23 @@
     [_sModule getPassKey:options resolver:resolve rejecter:reject];
 }
 
+- (void)cancelPassKeyAutoFill:(RCTPromiseResolveBlock)resolve
+                       reject:(RCTPromiseRejectBlock)reject {
+    [_sModule cancelPassKeyAutoFill:resolve rejecter:reject];
+}
+
+- (void)generatePkce:(RCTPromiseResolveBlock)resolve
+              reject:(RCTPromiseRejectBlock)reject {
+    [_sModule generatePkce:resolve rejecter:reject];
+}
+
+- (void)openAuthSession:(NSString *)url
+                options:(NSDictionary *)options
+                resolve:(RCTPromiseResolveBlock)resolve
+                 reject:(RCTPromiseRejectBlock)reject {
+    [_sModule openAuthSession:url options:options resolver:resolve rejecter:reject];
+}
+
 - (facebook::react::ModuleConstants<JS::NativeOauthEssentials::Constants>) constantsToExport {
   return (facebook::react::ModuleConstants<JS::NativeOauthEssentials::Constants>)[_sModule getConstants];
 }