react-native-security-suite 0.9.21 → 1.0.0-rc.1

package/ios/JWSGenerator.swift

@@ -0,0 +1,288 @@
+import Foundation
+import CryptoKit
+
+@available(iOS 13.0, *)
+struct JWSGenerator {
+    private static let safeHeaderKey = try! NSRegularExpression(pattern: "^[a-zA-Z][a-zA-Z0-9_-]*$")
+    private static let safeHeaderValue = try! NSRegularExpression(pattern: "^[\\x20-\\x7E]+$")
+
+    static func validateAlgorithm(_ algorithm: String?) throws -> String {
+        let value = algorithm ?? "HS256"
+        switch value {
+        case "HS256", "HS384", "HS512":
+            return value
+        default:
+            throw NSError(
+                domain: "JWS",
+                code: 1,
+                userInfo: [NSLocalizedDescriptionKey: "Unsupported JWS algorithm: \(value)"]
+            )
+        }
+    }
+
+    static func validateHeaderKey(_ key: String) throws {
+        let range = NSRange(key.startIndex..., in: key)
+        guard safeHeaderKey.firstMatch(in: key, range: range) != nil else {
+            throw NSError(domain: "JWS", code: 2, userInfo: [NSLocalizedDescriptionKey: "Invalid JWS header key: \(key)"])
+        }
+    }
+
+    static func validateHeaderValue(_ value: String) throws {
+        let range = NSRange(value.startIndex..., in: value)
+        guard safeHeaderValue.firstMatch(in: value, range: range) != nil else {
+            throw NSError(domain: "JWS", code: 3, userInfo: [NSLocalizedDescriptionKey: "Invalid JWS header value"])
+        }
+    }
+
+    static func resolveAlgorithm(_ algorithm: String?, headers: [String: Any]) throws -> String {
+        let headerAlg = headers["alg"] as? String
+
+        if let algorithm, let headerAlg, algorithm != headerAlg {
+            throw NSError(
+                domain: "JWS",
+                code: 7,
+                userInfo: [NSLocalizedDescriptionKey: "JWS algorithm mismatch: options.algorithm and headers.alg must match"]
+            )
+        }
+
+        if let algorithm, !algorithm.isEmpty {
+            return try validateAlgorithm(algorithm)
+        }
+
+        if let headerAlg, !headerAlg.isEmpty {
+            return try validateAlgorithm(headerAlg)
+        }
+
+        return "HS256"
+    }
+
+    static func generate(
+        payloadString: String,
+        secret: String,
+        algorithm: String?,
+        headers: [String: Any]?,
+        detached: Bool
+    ) throws -> String {
+        guard !secret.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty else {
+            throw NSError(
+                domain: "JWS",
+                code: 8,
+                userInfo: [NSLocalizedDescriptionKey: "JWS secret is required and must be a non-empty string"]
+            )
+        }
+
+        let normalizedHeaders = headers ?? [:]
+        let alg = try resolveAlgorithm(algorithm, headers: normalizedHeaders)
+        let protectedHeader = try buildProtectedHeader(algorithm: alg, headers: normalizedHeaders)
+
+        let encodedProtectedHeader = base64URLEncode(protectedHeader)
+        let encodedPayload = encodePayload(payloadString)
+        let signingInput = buildSigningInput(encodedProtectedHeader: encodedProtectedHeader, encodedPayload: encodedPayload)
+
+        let signature = try sign(
+            data: Data(signingInput.utf8),
+            secret: Data(secret.utf8),
+            algorithm: alg
+        )
+        let encodedSignature = base64URLEncode(signature)
+
+        return formatCompactJws(
+            encodedProtectedHeader: encodedProtectedHeader,
+            encodedPayload: encodedPayload,
+            encodedSignature: encodedSignature,
+            detached: detached
+        )
+    }
+
+    static func verify(
+        compactJWS: String,
+        payloadString: String,
+        secret: String,
+        algorithm: String?,
+        detached: Bool
+    ) throws -> Bool {
+        let encodedProtectedHeader: String
+        let encodedSignature: String
+
+        if detached {
+            let parts = compactJWS.components(separatedBy: "..")
+            guard parts.count == 2 else {
+                throw NSError(domain: "JWS", code: 6, userInfo: [NSLocalizedDescriptionKey: "Invalid compact detached JWS format"])
+            }
+            encodedProtectedHeader = parts[0]
+            encodedSignature = parts[1]
+        } else {
+            let parts = compactJWS.split(separator: ".", omittingEmptySubsequences: false)
+            guard parts.count == 3 else {
+                throw NSError(domain: "JWS", code: 6, userInfo: [NSLocalizedDescriptionKey: "Invalid compact JWS format"])
+            }
+            encodedProtectedHeader = String(parts[0])
+            encodedSignature = String(parts[2])
+        }
+
+        let alg = try validateAlgorithm(algorithm)
+        let encodedPayload = encodePayload(payloadString)
+        let signingInput = buildSigningInput(encodedProtectedHeader: encodedProtectedHeader, encodedPayload: encodedPayload)
+        let expected = try sign(data: Data(signingInput.utf8), secret: Data(secret.utf8), algorithm: alg)
+
+        guard let provided = Data(base64URLEncoded: encodedSignature) else {
+            return false
+        }
+        return expected == provided
+    }
+
+    private static func buildProtectedHeader(
+        algorithm: String,
+        headers: [String: Any]
+    ) throws -> Data {
+        var headerFields: [String: Any] = ["alg": algorithm]
+
+        let sortedKeys = headers.keys.sorted()
+        for key in sortedKeys {
+            if key == "alg" { continue }
+            try validateHeaderKey(key)
+            let value = headers[key]
+
+            if value is NSNull {
+                headerFields[key] = NSNull()
+            } else if let boolValue = value as? Bool {
+                headerFields[key] = boolValue
+            } else if let numberValue = value as? NSNumber {
+                headerFields[key] = numberValue
+            } else if let stringValue = value as? String {
+                try validateHeaderValue(stringValue)
+                headerFields[key] = stringValue
+            } else {
+                throw NSError(
+                    domain: "JWS",
+                    code: 9,
+                    userInfo: [NSLocalizedDescriptionKey: "JWS header values must be JSON-serializable primitives: \(key)"]
+                )
+            }
+        }
+
+        return try JSONSerialization.data(withJSONObject: headerFields, options: [.sortedKeys])
+    }
+
+    static func encodePayload(_ payloadString: String) -> String {
+        if payloadString.isEmpty {
+            return ""
+        }
+        return base64URLEncode(Data(payloadString.utf8))
+    }
+
+    static func buildSigningInput(encodedProtectedHeader: String, encodedPayload: String) -> String {
+        encodedProtectedHeader + "." + encodedPayload
+    }
+
+    static func formatCompactJws(
+        encodedProtectedHeader: String,
+        encodedPayload: String,
+        encodedSignature: String,
+        detached: Bool
+    ) -> String {
+        if detached {
+            return "\(encodedProtectedHeader)..\(encodedSignature)"
+        }
+        return "\(encodedProtectedHeader).\(encodedPayload).\(encodedSignature)"
+    }
+
+    private static func sign(data: Data, secret: Data, algorithm: String) throws -> Data {
+        let key = SymmetricKey(data: secret)
+        switch algorithm {
+        case "HS384":
+            return Data(HMAC<SHA384>.authenticationCode(for: data, using: key))
+        case "HS512":
+            return Data(HMAC<SHA512>.authenticationCode(for: data, using: key))
+        default:
+            return Data(HMAC<SHA256>.authenticationCode(for: data, using: key))
+        }
+    }
+
+    private static func base64URLEncode(_ data: Data) -> String {
+        data.base64EncodedString()
+            .replacingOccurrences(of: "+", with: "-")
+            .replacingOccurrences(of: "/", with: "_")
+            .replacingOccurrences(of: "=", with: "")
+    }
+}
+
+@available(iOS 13.0, *)
+enum JwsFetchPayload {
+    static func build(
+        url: String,
+        method: String,
+        requestBody: Data?,
+        jwsOptions: [String: Any]
+    ) throws -> String {
+        if let payload = jwsOptions["payload"] {
+            if payload is NSNull {
+                return ""
+            }
+            if let payloadString = payload as? String {
+                return payloadString
+            }
+            throw NSError(
+                domain: "JWS",
+                code: 10,
+                userInfo: [NSLocalizedDescriptionKey: "JWS fetch payload must be a string when provided"]
+            )
+        }
+
+        guard let requestUrl = URL(string: url) else {
+            throw NSError(domain: "JWS", code: 11, userInfo: [NSLocalizedDescriptionKey: "Invalid URL"])
+        }
+
+        var fields: [String: Any] = [
+            "method": method.uppercased(),
+            "path": requestUrl.path.isEmpty ? "/" : requestUrl.path,
+        ]
+
+        if let query = requestUrl.query, !query.isEmpty {
+            fields["query"] = query
+        }
+
+        if let requestBody, !requestBody.isEmpty {
+            let digest = SHA256.hash(data: requestBody)
+            fields["bodyHash"] = base64URLEncode(Data(digest))
+        }
+
+        if let headers = jwsOptions["headers"] as? [String: Any] {
+            for key in ["timestamp", "nonce", "request_id", "requestId"] {
+                if let value = headers[key], !(value is NSNull) {
+                    fields[key] = value
+                }
+            }
+        }
+
+        let sortedKeys = fields.keys.sorted()
+        var sortedFields: [String: Any] = [:]
+        for key in sortedKeys {
+            sortedFields[key] = fields[key]
+        }
+
+        let data = try JSONSerialization.data(withJSONObject: sortedFields, options: [.sortedKeys])
+        return String(decoding: data, as: UTF8.self)
+    }
+
+    private static func base64URLEncode(_ data: Data) -> String {
+        data.base64EncodedString()
+            .replacingOccurrences(of: "+", with: "-")
+            .replacingOccurrences(of: "/", with: "_")
+            .replacingOccurrences(of: "=", with: "")
+    }
+}
+
+@available(iOS 13.0, *)
+private extension Data {
+    init?(base64URLEncoded string: String) {
+        var base64 = string
+            .replacingOccurrences(of: "-", with: "+")
+            .replacingOccurrences(of: "_", with: "/")
+        let padding = 4 - base64.count % 4
+        if padding < 4 {
+            base64 += String(repeating: "=", count: padding)
+        }
+        self.init(base64Encoded: base64)
+    }
+}

package/ios/JWSGeneratorTests.swift

@@ -0,0 +1,168 @@
+import XCTest
+
+@available(iOS 13.0, *)
+final class JWSGeneratorTests: XCTestCase {
+    private let secret = "secret"
+
+    func testOmittedPayloadProducesThreeSegmentsWithEmptyMiddle() throws {
+        try assertEmptyPayload("")
+    }
+
+    func testEmptyStringPayloadProducesThreeSegmentsWithEmptyMiddle() throws {
+        try assertEmptyPayload("")
+    }
+
+    func testStringNullPayloadIsNotEmpty() throws {
+        let jws = try JWSGenerator.generate(
+            payloadString: "null",
+            secret: secret,
+            algorithm: "HS256",
+            headers: ["kid": "test-key"],
+            detached: false
+        )
+        let segments = jws.split(separator: ".", omittingEmptySubsequences: false)
+
+        XCTAssertEqual(segments.count, 3)
+        XCTAssertFalse(String(segments[1]).isEmpty)
+        XCTAssertEqual(String(segments[1]), base64URLEncode(Data("null".utf8)))
+    }
+
+    func testStringUndefinedPayloadIsNotEmpty() throws {
+        let jws = try JWSGenerator.generate(
+            payloadString: "undefined",
+            secret: secret,
+            algorithm: "HS256",
+            headers: ["kid": "test-key"],
+            detached: false
+        )
+        let segments = jws.split(separator: ".", omittingEmptySubsequences: false)
+
+        XCTAssertEqual(segments.count, 3)
+        XCTAssertEqual(String(segments[1]), base64URLEncode(Data("undefined".utf8)))
+    }
+
+    func testObjectPayloadIsBase64UrlEncodedJson() throws {
+        let payload = "{\"amount\":1000}"
+        let jws = try JWSGenerator.generate(
+            payloadString: payload,
+            secret: secret,
+            algorithm: "HS256",
+            headers: ["kid": "test-key"],
+            detached: false
+        )
+        let segments = jws.split(separator: ".", omittingEmptySubsequences: false)
+
+        XCTAssertEqual(segments.count, 3)
+        XCTAssertEqual(String(segments[1]), base64URLEncode(Data(payload.utf8)))
+    }
+
+    func testAlgorithmMismatchThrows() {
+        XCTAssertThrowsError(
+            try JWSGenerator.generate(
+                payloadString: "",
+                secret: secret,
+                algorithm: "HS512",
+                headers: ["alg": "HS256", "kid": "test-key"],
+                detached: false
+            )
+        )
+    }
+
+    func testAlgorithmFromHeaderIsUsed() throws {
+        let jws = try JWSGenerator.generate(
+            payloadString: "",
+            secret: secret,
+            algorithm: nil,
+            headers: ["alg": "HS384", "kid": "test-key"],
+            detached: false
+        )
+        let protectedHeader = String(jws.split(separator: ".", omittingEmptySubsequences: false)[0])
+        let decoded = try JSONSerialization.jsonObject(
+            with: Data(base64: base64URLToBase64(protectedHeader)),
+            options: []
+        ) as? [String: Any]
+
+        XCTAssertEqual(decoded?["alg"] as? String, "HS384")
+    }
+
+    func testDefaultAlgorithmIsHs256() throws {
+        let jws = try JWSGenerator.generate(
+            payloadString: "",
+            secret: secret,
+            algorithm: nil,
+            headers: ["kid": "test-key"],
+            detached: false
+        )
+        let protectedHeader = String(jws.split(separator: ".", omittingEmptySubsequences: false)[0])
+        let decoded = try JSONSerialization.jsonObject(
+            with: Data(base64: base64URLToBase64(protectedHeader)),
+            options: []
+        ) as? [String: Any]
+
+        XCTAssertEqual(decoded?["alg"] as? String, "HS256")
+    }
+
+    func testDetachedOutputUsesDoubleDot() throws {
+        let jws = try JWSGenerator.generate(
+            payloadString: "payload",
+            secret: secret,
+            algorithm: "HS256",
+            headers: ["kid": "test-key"],
+            detached: true
+        )
+
+        XCTAssertTrue(jws.contains(".."))
+        XCTAssertEqual(jws.components(separatedBy: "..").count, 2)
+        XCTAssertTrue(
+            try JWSGenerator.verify(
+                compactJWS: jws,
+                payloadString: "payload",
+                secret: secret,
+                algorithm: "HS256",
+                detached: true
+            )
+        )
+    }
+
+    private func assertEmptyPayload(_ payload: String) throws {
+        let jws = try JWSGenerator.generate(
+            payloadString: payload,
+            secret: secret,
+            algorithm: "HS256",
+            headers: ["kid": "test-key"],
+            detached: false
+        )
+        let segments = jws.split(separator: ".", omittingEmptySubsequences: false)
+
+        XCTAssertEqual(segments.count, 3)
+        XCTAssertEqual(String(segments[1]), "")
+        XCTAssertTrue(jws.contains(".."))
+        XCTAssertTrue(
+            try JWSGenerator.verify(
+                compactJWS: jws,
+                payloadString: payload,
+                secret: secret,
+                algorithm: "HS256",
+                detached: false
+            )
+        )
+    }
+
+    private func base64URLEncode(_ data: Data) -> String {
+        data.base64EncodedString()
+            .replacingOccurrences(of: "+", with: "-")
+            .replacingOccurrences(of: "/", with: "_")
+            .replacingOccurrences(of: "=", with: "")
+    }
+
+    private func base64URLToBase64(_ value: String) -> String {
+        var base64 = value
+            .replacingOccurrences(of: "-", with: "+")
+            .replacingOccurrences(of: "_", with: "/")
+        let padding = 4 - base64.count % 4
+        if padding < 4 {
+            base64 += String(repeating: "=", count: padding)
+        }
+        return base64
+    }
+}

package/ios/KeychainHelper.swift

@@ -0,0 +1,104 @@
+import Foundation
+import Security
+
+enum KeychainError: Error {
+    case unexpectedStatus(OSStatus)
+    case invalidData
+}
+
+@available(iOS 13.0, *)
+final class KeychainHelper {
+    static let shared = KeychainHelper()
+
+    private init() {}
+
+    func save(_ data: Data, service: String, account: String) throws {
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecAttrAccount as String: account,
+        ]
+        SecItemDelete(query as CFDictionary)
+
+        var attributes = query
+        attributes[kSecValueData as String] = data
+        attributes[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+
+        let status = SecItemAdd(attributes as CFDictionary, nil)
+        guard status == errSecSuccess else {
+            throw KeychainError.unexpectedStatus(status)
+        }
+    }
+
+    func load(service: String, account: String) throws -> Data? {
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecAttrAccount as String: account,
+            kSecReturnData as String: true,
+            kSecMatchLimit as String: kSecMatchLimitOne,
+        ]
+
+        var result: AnyObject?
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        if status == errSecItemNotFound {
+            return nil
+        }
+        guard status == errSecSuccess, let data = result as? Data else {
+            throw KeychainError.unexpectedStatus(status)
+        }
+        return data
+    }
+
+    func delete(service: String, account: String) throws {
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecAttrAccount as String: account,
+        ]
+        let status = SecItemDelete(query as CFDictionary)
+        guard status == errSecSuccess || status == errSecItemNotFound else {
+            throw KeychainError.unexpectedStatus(status)
+        }
+    }
+
+    func listAccounts(service: String) throws -> [String] {
+        let query: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecReturnAttributes as String: true,
+            kSecMatchLimit as String: kSecMatchLimitAll,
+        ]
+
+        var result: AnyObject?
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        if status == errSecItemNotFound {
+            return []
+        }
+        guard status == errSecSuccess else {
+            throw KeychainError.unexpectedStatus(status)
+        }
+
+        if let items = result as? [[String: Any]] {
+            return items.compactMap { $0[kSecAttrAccount as String] as? String }
+        }
+        if let item = result as? [String: Any],
+           let account = item[kSecAttrAccount as String] as? String {
+            return [account]
+        }
+        return []
+    }
+
+    func saveECDHKeyPair(privateKey: Data, publicKey: Data) throws {
+        try save(privateKey, service: "com.securitysuite.ecdh", account: "private")
+        try save(publicKey, service: "com.securitysuite.ecdh", account: "public")
+    }
+
+    func loadECDHKeyPair() throws -> (privateKey: Data, publicKey: Data)? {
+        guard let privateKey = try load(service: "com.securitysuite.ecdh", account: "private"),
+              let publicKey = try load(service: "com.securitysuite.ecdh", account: "public") else {
+            return nil
+        }
+        return (privateKey, publicKey)
+    }
+}

package/ios/Obfuscation.swift

@@ -0,0 +1,42 @@
+import Foundation
+import CryptoKit
+
+@available(iOS 13.0, *)
+final class Obfuscation {
+    private func deriveKey(_ secret: String) throws -> SymmetricKey {
+        guard !secret.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty else {
+            throw NSError(
+                domain: "Obfuscation",
+                code: 1,
+                userInfo: [NSLocalizedDescriptionKey: "Obfuscation secret is required"]
+            )
+        }
+        let hash = SHA256.hash(data: Data(secret.utf8))
+        return SymmetricKey(data: Data(hash))
+    }
+
+    func obfuscate(plain: String, secret: String) throws -> String {
+        let symmetricKey = try deriveKey(secret)
+        guard let plainData = plain.data(using: .utf8) else {
+            throw NSError(domain: "Obfuscation", code: 2, userInfo: [NSLocalizedDescriptionKey: "Invalid plaintext"])
+        }
+        let encrypted = try AES.GCM.seal(plainData, using: symmetricKey)
+        guard let combined = encrypted.combined else {
+            throw NSError(domain: "Obfuscation", code: 3, userInfo: [NSLocalizedDescriptionKey: "Obfuscation failed"])
+        }
+        return combined.base64EncodedString()
+    }
+
+    func deobfuscate(encoded: String, secret: String) throws -> String {
+        guard let decodedData = Data(base64Encoded: encoded) else {
+            throw NSError(domain: "Obfuscation", code: 4, userInfo: [NSLocalizedDescriptionKey: "Invalid obfuscated payload"])
+        }
+        let symmetricKey = try deriveKey(secret)
+        let sealedBox = try AES.GCM.SealedBox(combined: decodedData)
+        let decrypted = try AES.GCM.open(sealedBox, using: symmetricKey)
+        guard let result = String(data: decrypted, encoding: .utf8) else {
+            throw NSError(domain: "Obfuscation", code: 5, userInfo: [NSLocalizedDescriptionKey: "Invalid UTF-8 output"])
+        }
+        return result
+    }
+}

package/ios/SecureStorageNative.swift

@@ -0,0 +1,84 @@
+import Foundation
+
+@available(iOS 13.0, *)
+final class SecureStorageNative {
+    static let shared = SecureStorageNative()
+    private let service = "com.securitysuite.secure_storage"
+    private let keyPrefix = "rss:"
+    private let keychain = KeychainHelper.shared
+
+    private init() {}
+
+    private func namespacedKey(_ key: String) throws -> String {
+        let trimmed = key.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !trimmed.isEmpty else {
+            throw secureStorageError("Storage key is required")
+        }
+        return "\(keyPrefix)\(trimmed)"
+    }
+
+    private func secureStorageError(_ detail: String) -> NSError {
+        NSError(
+            domain: "SecureStorage",
+            code: 1,
+            userInfo: [NSLocalizedDescriptionKey: "Secure storage operation failed: \(detail)"]
+        )
+    }
+
+    func setItem(key: String, value: String) throws {
+        let data = Data(value.utf8)
+        do {
+            try keychain.save(data, service: service, account: try namespacedKey(key))
+        } catch {
+            throw secureStorageError(error.localizedDescription)
+        }
+    }
+
+    func getItem(key: String) throws -> String? {
+        do {
+            guard let data = try keychain.load(service: service, account: try namespacedKey(key)) else {
+                return nil
+            }
+            guard let value = String(data: data, encoding: .utf8) else {
+                throw secureStorageError("Stored value is not valid UTF-8 text")
+            }
+            return value
+        } catch let error as NSError where error.domain == "SecureStorage" {
+            throw error
+        } catch {
+            throw secureStorageError(error.localizedDescription)
+        }
+    }
+
+    func removeItem(key: String) throws {
+        do {
+            try keychain.delete(service: service, account: try namespacedKey(key))
+        } catch {
+            throw secureStorageError(error.localizedDescription)
+        }
+    }
+
+    func getAllKeys() throws -> [String] {
+        do {
+            return try keychain
+                .listAccounts(service: service)
+                .filter { $0.hasPrefix(keyPrefix) }
+                .map { String($0.dropFirst(keyPrefix.count)) }
+                .sorted()
+        } catch {
+            throw secureStorageError(error.localizedDescription)
+        }
+    }
+
+    func clear() throws {
+        do {
+            for key in try getAllKeys() {
+                try removeItem(key: key)
+            }
+        } catch let error as NSError where error.domain == "SecureStorage" {
+            throw error
+        } catch {
+            throw secureStorageError(error.localizedDescription)
+        }
+    }
+}