react-native-security-suite 0.9.22 → 1.0.0-rc.1

package/android/src/main/java/com/securitysuite/SecuritySuiteModule.java

@@ -1,203 +1,411 @@
 package com.securitysuite;
 
+import com.facebook.react.bridge.Arguments;
 import com.facebook.react.bridge.Callback;
 import com.facebook.react.bridge.Promise;
 import com.facebook.react.bridge.ReactApplicationContext;
 import com.facebook.react.bridge.ReactContextBaseJavaModule;
 import com.facebook.react.bridge.ReactMethod;
+import com.facebook.react.bridge.ReadableArray;
 import com.facebook.react.bridge.ReadableMap;
+import com.facebook.react.bridge.WritableArray;
 import com.facebook.react.module.annotations.ReactModule;
 
 import androidx.annotation.NonNull;
 
-import android.annotation.SuppressLint;
-import android.provider.Settings;
 import android.util.Base64;
 import android.util.Log;
 
 import java.nio.charset.Charset;
-import java.security.InvalidAlgorithmParameterException;
-import java.security.InvalidKeyException;
+import java.nio.charset.StandardCharsets;
 import java.security.KeyFactory;
-import java.security.KeyPair;
-import java.security.KeyPairGenerator;
-import java.security.NoSuchAlgorithmException;
 import java.security.PrivateKey;
 import java.security.PublicKey;
-import java.security.spec.ECGenParameterSpec;
 import java.security.spec.X509EncodedKeySpec;
 
-import javax.crypto.BadPaddingException;
 import javax.crypto.Cipher;
-import javax.crypto.IllegalBlockSizeException;
 import javax.crypto.KeyAgreement;
-import javax.crypto.NoSuchPaddingException;
 import javax.crypto.SecretKey;
 import javax.crypto.spec.GCMParameterSpec;
 import javax.crypto.spec.SecretKeySpec;
 
 import com.scottyab.rootbeer.RootBeer;
 
+import com.securitysuite.security.AppIntegrityChecker;
+import com.securitysuite.security.EmulatorDetector;
+import com.securitysuite.security.RuntimeDetector;
+
 @ReactModule(name = SecuritySuiteModule.NAME)
 public class SecuritySuiteModule extends ReactContextBaseJavaModule {
   public static final String NAME = "SecuritySuite";
-  private ReactApplicationContext context;
+  private final ReactApplicationContext context;
 
-  KeyPairGenerator keyPairGenerator;
-  KeyPair keyPair;
-  PublicKey publicKey;
-  PublicKey serverPublicKey;
-  PrivateKey privateKey;
-  String sharedKey;
-  SecretKey secretKey;
+  private SecretKey encryptionKey;
+  private SecretKey hmacKey;
+  private CryptoConfig cryptoConfig = CryptoConfig.defaults();
 
   public SecuritySuiteModule(ReactApplicationContext reactContext) {
     super(reactContext);
     context = reactContext;
-    generateKeyPair();
   }
 
-  private void generateKeyPair() {
+  @ReactMethod
+  public void getPublicKey(Promise promise) {
     try {
-      keyPairGenerator = KeyPairGenerator.getInstance("EC");
-      ECGenParameterSpec prime256v1ParamSpec = new ECGenParameterSpec("secp256r1");
-      keyPairGenerator.initialize(prime256v1ParamSpec);
-      keyPair = keyPairGenerator.genKeyPair();
-      publicKey = keyPair.getPublic();
-      privateKey = keyPair.getPrivate();
+      promise.resolve(EcdhKeyStore.getPublicKeyBase64(context));
     } catch (Exception e) {
-      Log.e("generateKeyPair Error: ", String.valueOf(e));
+      promise.reject("GET_PUBLIC_KEY_ERROR", e.getMessage(), e);
     }
   }
 
   @ReactMethod
-  public void getPublicKey(Promise promise) {
-    String base64DEREncoded = Base64.encodeToString(publicKey.getEncoded(), Base64.NO_WRAP);
-    promise.resolve(base64DEREncoded);
-  }
-
-  private static SecretKey agreeSecretKey(PrivateKey prk_self, PublicKey pbk_peer, boolean lastPhase) throws Exception {
-    SecretKey desSpec;
+  public void establishSharedKey(String serverPK, ReadableMap options, Promise promise) {
     try {
-      KeyAgreement keyAgree = KeyAgreement.getInstance("ECDH");
-      keyAgree.init(prk_self);
-      keyAgree.doPhase(pbk_peer, true);
-      byte[] sec = keyAgree.generateSecret();
-      desSpec = new SecretKeySpec(sec, "AES");
-    } catch (NoSuchAlgorithmException e) {
-      throw new Exception();
-    } catch (InvalidKeyException e) {
-      throw new Exception();
+      if (serverPK == null || serverPK.trim().isEmpty()) {
+        promise.reject("GET_SHARED_KEY_ERROR", "Server public key is required");
+        return;
+      }
+
+      cryptoConfig = CryptoConfig.fromReadableMap(options);
+
+      X509EncodedKeySpec keySpec = new X509EncodedKeySpec(
+          Base64.decode(serverPK.trim(), Base64.NO_WRAP)
+      );
+      KeyFactory keyFactory = KeyFactory.getInstance(cryptoConfig.keyFactoryAlgorithm);
+      PublicKey serverPublicKey = keyFactory.generatePublic(keySpec);
+      PrivateKey privateKey = EcdhKeyStore.getPrivateKey(context);
+
+      KeyAgreement keyAgree = KeyAgreement.getInstance(cryptoConfig.keyAgreementAlgorithm);
+      keyAgree.init(privateKey);
+      keyAgree.doPhase(serverPublicKey, true);
+      byte[] sharedSecret = keyAgree.generateSecret();
+
+      byte[] encKeyBytes = CryptoUtils.deriveEncryptionKey(sharedSecret);
+      byte[] macKeyBytes = CryptoUtils.deriveHmacKey(sharedSecret);
+      encryptionKey = new SecretKeySpec(encKeyBytes, cryptoConfig.encryptionKeyAlgorithm);
+      hmacKey = new SecretKeySpec(macKeyBytes, cryptoConfig.hmacKeyAlgorithm);
+
+      promise.resolve(null);
+    } catch (Exception e) {
+      Log.e("establishSharedKey Error: ", String.valueOf(e));
+      promise.reject("GET_SHARED_KEY_ERROR", e.getMessage(), e);
     }
-    return desSpec;
   }
 
   @ReactMethod
-  public void getSharedKey(String serverPK, Promise promise) {
+  public void getSharedKey(String serverPK, ReadableMap options, Promise promise) {
     try {
-      X509EncodedKeySpec keySpec = new X509EncodedKeySpec(Base64.decode(serverPK.getBytes(), Base64.NO_WRAP)); // Change ASN1 to publicKey
-      KeyFactory keyFactory = KeyFactory.getInstance("EC");
-      serverPublicKey = keyFactory.generatePublic(keySpec);
-      secretKey = agreeSecretKey(keyPair.getPrivate(), serverPublicKey, true);
-      sharedKey = Base64.encodeToString(secretKey.getEncoded(), Base64.NO_WRAP);
-      promise.resolve(sharedKey);
+      if (serverPK == null || serverPK.trim().isEmpty()) {
+        promise.reject("GET_SHARED_KEY_ERROR", "Server public key is required");
+        return;
+      }
+
+      cryptoConfig = CryptoConfig.fromReadableMap(options);
+
+      X509EncodedKeySpec keySpec = new X509EncodedKeySpec(
+          Base64.decode(serverPK.trim(), Base64.NO_WRAP)
+      );
+      KeyFactory keyFactory = KeyFactory.getInstance(cryptoConfig.keyFactoryAlgorithm);
+      PublicKey serverPublicKey = keyFactory.generatePublic(keySpec);
+      PrivateKey privateKey = EcdhKeyStore.getPrivateKey(context);
+
+      KeyAgreement keyAgree = KeyAgreement.getInstance(cryptoConfig.keyAgreementAlgorithm);
+      keyAgree.init(privateKey);
+      keyAgree.doPhase(serverPublicKey, true);
+      byte[] sharedSecret = keyAgree.generateSecret();
+
+      byte[] encKeyBytes = CryptoUtils.deriveEncryptionKey(sharedSecret);
+      byte[] macKeyBytes = CryptoUtils.deriveHmacKey(sharedSecret);
+      encryptionKey = new SecretKeySpec(encKeyBytes, cryptoConfig.encryptionKeyAlgorithm);
+      hmacKey = new SecretKeySpec(macKeyBytes, cryptoConfig.hmacKeyAlgorithm);
+
+      promise.resolve(Base64.encodeToString(encKeyBytes, Base64.NO_WRAP));
     } catch (Exception e) {
       Log.e("getSharedKey Error: ", String.valueOf(e));
-      promise.reject(String.valueOf(e));
+      promise.reject("GET_SHARED_KEY_ERROR", e.getMessage(), e);
     }
   }
 
   @ReactMethod
-  public void encrypt(String input, Promise promise) {
+  public void encrypt(String input, ReadableMap options, Promise promise) {
     try {
-      byte[] inputByte = input.getBytes();
-      Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
-      byte[] decodedKey = Base64.decode(sharedKey, Base64.NO_WRAP);
-      SecretKey secretKeySpec = new SecretKeySpec(decodedKey, 0, decodedKey.length, "AES");
-      cipher.init(Cipher.ENCRYPT_MODE, secretKeySpec);
+      if (encryptionKey == null) {
+        promise.reject("ENCRYPT_ERROR", "Encryption key not established. Call getSharedKey first.");
+        return;
+      }
+      CryptoConfig config = cryptoConfig.merge(options);
+      byte[] inputByte = input.getBytes(StandardCharsets.UTF_8);
+      Cipher cipher = Cipher.getInstance(config.cipherTransformation);
+      cipher.init(Cipher.ENCRYPT_MODE, encryptionKey);
       byte[] iv = cipher.getIV();
-      assert iv.length == 12;
       byte[] cipherText = cipher.doFinal(inputByte);
-      if (cipherText.length != inputByte.length + 16)
-        throw new IllegalStateException();
-      byte[] output = new byte[12 + inputByte.length + 16];
-      System.arraycopy(iv, 0, output, 0, 12);
-      System.arraycopy(cipherText, 0, output, 12, cipherText.length);
+      byte[] output = new byte[iv.length + cipherText.length];
+      System.arraycopy(iv, 0, output, 0, iv.length);
+      System.arraycopy(cipherText, 0, output, iv.length, cipherText.length);
       promise.resolve(Base64.encodeToString(output, Base64.NO_WRAP));
     } catch (Exception e) {
-      Log.e("encrypt Error: ", String.valueOf(e));
-      promise.reject(String.valueOf(e));
+      promise.reject("ENCRYPT_ERROR", e.getMessage(), e);
     }
   }
 
   @ReactMethod
-  public void decrypt(String input, Promise promise) {
+  public void decrypt(String input, ReadableMap options, Promise promise) {
     try {
-      byte[] inputBytes = Base64.decode(input.getBytes(), Base64.NO_WRAP);
-      if (inputBytes.length < 12 + 16)
-        throw new IllegalArgumentException();
-      Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
-      GCMParameterSpec params = new GCMParameterSpec(128, inputBytes, 0, 12);
-      byte[] decodedKey = Base64.decode(sharedKey, Base64.NO_WRAP);
-      SecretKey secretKeySpec = new SecretKeySpec(decodedKey, 0, decodedKey.length, "AES");
-      cipher.init(Cipher.DECRYPT_MODE, secretKeySpec, params);
-      byte[] plaintext = cipher.doFinal(inputBytes, 12, inputBytes.length - 12);
-      String decrypted = new String(plaintext, Charset.forName("UTF-8"));
-      promise.resolve(decrypted);
-    } catch (NoSuchAlgorithmException | NoSuchPaddingException | InvalidKeyException | IllegalBlockSizeException
-        | BadPaddingException | InvalidAlgorithmParameterException e) {
-      promise.reject(e);
+      if (encryptionKey == null) {
+        promise.reject("DECRYPT_ERROR", "Encryption key not established. Call getSharedKey first.");
+        return;
+      }
+      CryptoConfig config = cryptoConfig.merge(options);
+      byte[] inputBytes = Base64.decode(input.getBytes(StandardCharsets.UTF_8), Base64.NO_WRAP);
+      int minLength = config.gcmIvLength + (config.gcmTagLength / 8);
+      if (inputBytes.length < minLength) {
+        promise.reject("DECRYPT_ERROR", "Invalid ciphertext");
+        return;
+      }
+      Cipher cipher = Cipher.getInstance(config.cipherTransformation);
+      GCMParameterSpec params = new GCMParameterSpec(
+          config.gcmTagLength,
+          inputBytes,
+          0,
+          config.gcmIvLength
+      );
+      cipher.init(Cipher.DECRYPT_MODE, encryptionKey, params);
+      byte[] plaintext = cipher.doFinal(
+          inputBytes,
+          config.gcmIvLength,
+          inputBytes.length - config.gcmIvLength
+      );
+      promise.resolve(new String(plaintext, Charset.forName("UTF-8")));
+    } catch (Exception e) {
+      promise.reject("DECRYPT_ERROR", e.getMessage(), e);
     }
   }
 
   @ReactMethod
-  public void getDeviceId(Callback callback) {
+  public void generateJWS(ReadableMap options, Promise promise) {
     try {
-      String deviceId = getAndroidId();
-      callback.invoke(deviceId, null);
+      if (options == null || !options.hasKey("secret")) {
+        promise.reject("JWS_ERROR", "JWS secret is required and must be a non-empty string");
+        return;
+      }
+
+      String secret = options.getString("secret");
+      if (secret == null || secret.trim().isEmpty()) {
+        promise.reject("JWS_ERROR", "JWS secret is required and must be a non-empty string");
+        return;
+      }
+
+      String payload = "";
+      if (options.hasKey("payload") && !options.isNull("payload")) {
+        payload = options.getString("payload");
+        if (payload == null) {
+          payload = "";
+        }
+      }
+
+      String algorithm = options.hasKey("algorithm") ? options.getString("algorithm") : null;
+      ReadableMap headers = options.hasKey("headers") ? options.getMap("headers") : null;
+      boolean detached = options.hasKey("detached") && options.getBoolean("detached");
+
+      JWSGenerator generator = new JWSGenerator();
+      String jws = generator.generate(payload, secret, algorithm, headers, detached);
+      promise.resolve(jws);
     } catch (Exception e) {
-      callback.invoke(null, e);
+      promise.reject("JWS_ERROR", e.getMessage(), e);
     }
   }
 
+  @ReactMethod
+  public void obfuscate(String input, String secret, Promise promise) {
+    try {
+      promise.resolve(Obfuscation.obfuscate(input, secret));
+    } catch (Exception e) {
+      promise.reject("OBFUSCATE_ERROR", e.getMessage(), e);
+    }
+  }
+
+  @ReactMethod
+  public void deobfuscate(String input, String secret, Promise promise) {
+    try {
+      promise.resolve(Obfuscation.deobfuscate(input, secret));
+    } catch (Exception e) {
+      promise.reject("DEOBFUSCATE_ERROR", e.getMessage(), e);
+    }
+  }
+
+  /** @deprecated Use obfuscate() or SecureStorage instead. */
   @ReactMethod
   public void storageEncrypt(String input, String secretKey, Boolean hardEncryption, Callback callback) {
     try {
-      String key = getAndroidId();
-      if (secretKey != null) {
-        key = secretKey;
+      if (secretKey == null || secretKey.trim().isEmpty()) {
+        callback.invoke(null, "secretKey is required. Device identifiers are not accepted as encryption keys.");
+        return;
       }
-      String encryptedMessage = StorageEncryption.encrypt(input, key, hardEncryption);
-      callback.invoke(encryptedMessage, null);
+      if (Boolean.TRUE.equals(hardEncryption)) {
+        callback.invoke(
+            null,
+            "hardEncryption is deprecated. Use SecureStorage for encrypted-at-rest data."
+        );
+        return;
+      }
+      callback.invoke(Obfuscation.obfuscate(input, secretKey), null);
     } catch (Exception e) {
-      callback.invoke(null, e);
+      callback.invoke(null, e.getMessage());
     }
   }
 
+  /** @deprecated Use deobfuscate() or SecureStorage APIs instead. */
   @ReactMethod
   public void storageDecrypt(String input, String secretKey, Boolean hardEncryption, Callback callback) {
     try {
-      String key = getAndroidId();
-      if (secretKey != null) {
-        key = secretKey;
+      if (secretKey == null || secretKey.trim().isEmpty()) {
+        callback.invoke(null, "secretKey is required. Device identifiers are not accepted as encryption keys.");
+        return;
+      }
+      if (Boolean.TRUE.equals(hardEncryption)) {
+        callback.invoke(
+            null,
+            "hardEncryption is deprecated. Use SecureStorage for encrypted-at-rest data."
+        );
+        return;
       }
-      String decryptedMessage = StorageEncryption.decrypt(input, key);
-      callback.invoke(decryptedMessage, null);
+      callback.invoke(Obfuscation.deobfuscate(input, secretKey), null);
     } catch (Exception e) {
       callback.invoke(null, e.getMessage());
     }
   }
 
-  @SuppressLint("HardwareIds")
-  private String getAndroidId() {
-    return Settings.Secure.getString(context.getContentResolver(),
-        Settings.Secure.ANDROID_ID);
+  @ReactMethod
+  public void secureStorageSetItem(String key, String value, Promise promise) {
+    try {
+      SecureStorageNative.setItem(context, key, value);
+      promise.resolve(null);
+    } catch (Exception e) {
+      promise.reject("SECURE_STORAGE_ERROR", secureStorageMessage(e), e);
+    }
+  }
+
+  @ReactMethod
+  public void secureStorageGetItem(String key, Promise promise) {
+    try {
+      promise.resolve(SecureStorageNative.getItem(context, key));
+    } catch (Exception e) {
+      promise.reject("SECURE_STORAGE_ERROR", secureStorageMessage(e), e);
+    }
+  }
+
+  @ReactMethod
+  public void secureStorageRemoveItem(String key, Promise promise) {
+    try {
+      SecureStorageNative.removeItem(context, key);
+      promise.resolve(null);
+    } catch (Exception e) {
+      promise.reject("SECURE_STORAGE_ERROR", secureStorageMessage(e), e);
+    }
+  }
+
+  @ReactMethod
+  public void secureStorageClear(Promise promise) {
+    try {
+      SecureStorageNative.clear(context);
+      promise.resolve(null);
+    } catch (Exception e) {
+      promise.reject("SECURE_STORAGE_ERROR", secureStorageMessage(e), e);
+    }
+  }
+
+  @ReactMethod
+  public void secureStorageGetAllKeys(Promise promise) {
+    try {
+      promise.resolve(SecureStorageNative.getAllKeys(context));
+    } catch (Exception e) {
+      promise.reject("SECURE_STORAGE_ERROR", secureStorageMessage(e), e);
+    }
+  }
+
+  @ReactMethod
+  public void secureStorageMultiSet(ReadableArray pairs, Promise promise) {
+    try {
+      SecureStorageNative.multiSet(context, pairs);
+      promise.resolve(null);
+    } catch (Exception e) {
+      promise.reject("SECURE_STORAGE_ERROR", secureStorageMessage(e), e);
+    }
+  }
+
+  @ReactMethod
+  public void secureStorageMultiGet(ReadableArray keys, Promise promise) {
+    try {
+      promise.resolve(SecureStorageNative.multiGet(context, keys));
+    } catch (Exception e) {
+      promise.reject("SECURE_STORAGE_ERROR", secureStorageMessage(e), e);
+    }
+  }
+
+  @ReactMethod
+  public void secureStorageMultiRemove(ReadableArray keys, Promise promise) {
+    try {
+      SecureStorageNative.multiRemove(context, keys);
+      promise.resolve(null);
+    } catch (Exception e) {
+      promise.reject("SECURE_STORAGE_ERROR", secureStorageMessage(e), e);
+    }
+  }
+
+  private static String secureStorageMessage(Exception error) {
+    String message = error.getMessage();
+    if (message != null && !message.isEmpty()) {
+      return message;
+    }
+    return "Secure storage operation failed";
   }
 
   @ReactMethod
   public void fetch(String url, final ReadableMap options, Callback callback) {
     Sslpinning sslpinning = new Sslpinning(context);
-    sslpinning.fetch(url, options, secretKey, callback);
+    sslpinning.fetch(url, options, callback);
+  }
+
+  @ReactMethod
+  public void getDeviceId(Callback callback) {
+    try {
+      callback.invoke(
+          android.provider.Settings.Secure.getString(
+              context.getContentResolver(),
+              android.provider.Settings.Secure.ANDROID_ID
+          ),
+          null
+      );
+    } catch (Exception e) {
+      callback.invoke(null, e.getMessage());
+    }
+  }
+
+  @ReactMethod
+  public void runtimeDetect(Promise promise) {
+    try {
+      promise.resolve(RuntimeDetector.detect());
+    } catch (Exception e) {
+      promise.reject("RUNTIME_DETECT_ERROR", e.getMessage(), e);
+    }
+  }
+
+  @ReactMethod
+  public void appIntegrityVerify(Promise promise) {
+    try {
+      promise.resolve(AppIntegrityChecker.verify(context));
+    } catch (Exception e) {
+      promise.reject("APP_INTEGRITY_ERROR", e.getMessage(), e);
+    }
+  }
+
+  @ReactMethod
+  public void deviceGetEnvironment(Promise promise) {
+    try {
+      promise.resolve(EmulatorDetector.detect(context));
+    } catch (Exception e) {
+      promise.reject("DEVICE_ENVIRONMENT_ERROR", e.getMessage(), e);
+    }
   }
 
   @ReactMethod