react-native-security-suite 0.9.22 → 1.0.0-rc.2

package/android/src/main/java/com/securitysuite/Obfuscation.java

@@ -0,0 +1,57 @@
+package com.securitysuite;
+
+import android.util.Base64;
+
+import java.security.MessageDigest;
+import java.security.SecureRandom;
+import java.util.Arrays;
+
+import javax.crypto.Cipher;
+import javax.crypto.spec.IvParameterSpec;
+import javax.crypto.spec.SecretKeySpec;
+
+/**
+ * Local obfuscation only — NOT secure encryption. Requires an explicit user-provided secret.
+ * Never use for credentials, tokens, or PII at rest.
+ */
+public class Obfuscation {
+  private static byte[] deriveKey(String secret) throws Exception {
+    if (secret == null || secret.trim().isEmpty()) {
+      throw new IllegalArgumentException("Obfuscation secret is required");
+    }
+    MessageDigest md = MessageDigest.getInstance("SHA-256");
+    return md.digest(secret.getBytes("utf-8"));
+  }
+
+  public static String obfuscate(String input, String secret) throws Exception {
+    byte[] iv = CryptoUtils.randomBytes(16);
+    Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
+    cipher.init(
+        Cipher.ENCRYPT_MODE,
+        new SecretKeySpec(deriveKey(secret), "AES"),
+        new IvParameterSpec(iv)
+    );
+    byte[] cipherText = cipher.doFinal(input.getBytes("utf-8"));
+    byte[] ivAndCipherText = new byte[iv.length + cipherText.length];
+    System.arraycopy(iv, 0, ivAndCipherText, 0, iv.length);
+    System.arraycopy(cipherText, 0, ivAndCipherText, iv.length, cipherText.length);
+    return Base64.encodeToString(ivAndCipherText, Base64.NO_WRAP);
+  }
+
+  public static String deobfuscate(String encoded, String secret) throws Exception {
+    byte[] ivAndCipherText = Base64.decode(encoded, Base64.NO_WRAP);
+    if (ivAndCipherText.length < 17) {
+      throw new IllegalArgumentException("Invalid obfuscated payload");
+    }
+    byte[] iv = Arrays.copyOfRange(ivAndCipherText, 0, 16);
+    byte[] cipherText = Arrays.copyOfRange(ivAndCipherText, 16, ivAndCipherText.length);
+
+    Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
+    cipher.init(
+        Cipher.DECRYPT_MODE,
+        new SecretKeySpec(deriveKey(secret), "AES"),
+        new IvParameterSpec(iv)
+    );
+    return new String(cipher.doFinal(cipherText), "utf-8");
+  }
+}

package/android/src/main/java/com/securitysuite/SecureStorageNative.java

@@ -0,0 +1,211 @@
+package com.securitysuite;
+
+import android.content.Context;
+import android.content.SharedPreferences;
+import android.security.keystore.KeyPermanentlyInvalidatedException;
+
+import androidx.security.crypto.EncryptedSharedPreferences;
+import androidx.security.crypto.MasterKey;
+
+import com.facebook.react.bridge.Arguments;
+import com.facebook.react.bridge.ReadableArray;
+import com.facebook.react.bridge.WritableArray;
+
+import java.io.IOException;
+import java.security.GeneralSecurityException;
+import java.security.KeyStoreException;
+import java.security.ProviderException;
+import java.security.UnrecoverableKeyException;
+import java.util.Map;
+
+/**
+ * Hardware-backed encrypted storage via Android Keystore + EncryptedSharedPreferences.
+ * Keys are managed by the system — no hardcoded secrets or salts.
+ */
+public final class SecureStorageNative {
+  private static final String PREFS_FILE = "com.securitysuite.secure_storage";
+  private static final String KEY_PREFIX = "rss:";
+  private static final String SECURE_STORAGE_FAILED = "Secure storage operation failed";
+
+  private static volatile SharedPreferences cachedPreferences;
+
+  private SecureStorageNative() {}
+
+  private static boolean isKeyStoreOrDecryptionFailure(Throwable error) {
+    Throwable current = error;
+    while (current != null) {
+      if (current instanceof GeneralSecurityException
+          || current instanceof KeyStoreException
+          || current instanceof UnrecoverableKeyException
+          || current instanceof KeyPermanentlyInvalidatedException
+          || current instanceof ProviderException
+          || current instanceof IOException) {
+        return true;
+      }
+      current = current.getCause();
+    }
+    return false;
+  }
+
+  private static SharedPreferences createEncryptedPreferences(Context context)
+      throws GeneralSecurityException, IOException {
+    MasterKey masterKey =
+        new MasterKey.Builder(context)
+            .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
+            .build();
+
+    return EncryptedSharedPreferences.create(
+        context,
+        PREFS_FILE,
+        masterKey,
+        EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
+        EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM);
+  }
+
+  private static SharedPreferences getPreferences(Context context) throws Exception {
+    SharedPreferences preferences = cachedPreferences;
+    if (preferences != null) {
+      return preferences;
+    }
+
+    synchronized (SecureStorageNative.class) {
+      if (cachedPreferences != null) {
+        return cachedPreferences;
+      }
+
+      try {
+        cachedPreferences = createEncryptedPreferences(context.getApplicationContext());
+        return cachedPreferences;
+      } catch (Exception initialError) {
+        if (!isKeyStoreOrDecryptionFailure(initialError)) {
+          throw new Exception(
+              SECURE_STORAGE_FAILED + ": KeyStore initialization failed", initialError);
+        }
+
+        // One-time recovery: drop legacy/plaintext prefs so encrypted storage starts fresh.
+        context.getApplicationContext().deleteSharedPreferences(PREFS_FILE);
+        cachedPreferences = null;
+
+        try {
+          cachedPreferences = createEncryptedPreferences(context.getApplicationContext());
+          return cachedPreferences;
+        } catch (Exception retryError) {
+          throw new Exception(
+              SECURE_STORAGE_FAILED + ": KeyStore initialization failed", retryError);
+        }
+      }
+    }
+  }
+
+  private static String namespacedKey(String key) throws IllegalArgumentException {
+    if (key == null || key.trim().isEmpty()) {
+      throw new IllegalArgumentException("Storage key is required");
+    }
+    return KEY_PREFIX + key.trim();
+  }
+
+  private static Exception secureStorageException(String operation, Exception error) {
+    String detail = error.getMessage();
+    if (detail == null || detail.isEmpty()) {
+      detail = error.getClass().getSimpleName();
+    }
+    return new Exception(SECURE_STORAGE_FAILED + " (" + operation + "): " + detail, error);
+  }
+
+  public static void setItem(Context context, String key, String value) throws Exception {
+    try {
+      getPreferences(context).edit().putString(namespacedKey(key), value).apply();
+    } catch (Exception error) {
+      throw secureStorageException("setItem", error);
+    }
+  }
+
+  public static String getItem(Context context, String key) throws Exception {
+    try {
+      return getPreferences(context).getString(namespacedKey(key), null);
+    } catch (Exception error) {
+      throw secureStorageException("getItem", error);
+    }
+  }
+
+  public static void removeItem(Context context, String key) throws Exception {
+    try {
+      getPreferences(context).edit().remove(namespacedKey(key)).apply();
+    } catch (Exception error) {
+      throw secureStorageException("removeItem", error);
+    }
+  }
+
+  public static void clear(Context context) throws Exception {
+    try {
+      SharedPreferences prefs = getPreferences(context);
+      SharedPreferences.Editor editor = prefs.edit();
+      for (Map.Entry<String, ?> entry : prefs.getAll().entrySet()) {
+        if (entry.getKey().startsWith(KEY_PREFIX)) {
+          editor.remove(entry.getKey());
+        }
+      }
+      editor.apply();
+    } catch (Exception error) {
+      throw secureStorageException("clear", error);
+    }
+  }
+
+  public static WritableArray getAllKeys(Context context) throws Exception {
+    try {
+      WritableArray keys = Arguments.createArray();
+      for (Map.Entry<String, ?> entry : getPreferences(context).getAll().entrySet()) {
+        if (entry.getKey().startsWith(KEY_PREFIX)) {
+          keys.pushString(entry.getKey().substring(KEY_PREFIX.length()));
+        }
+      }
+      return keys;
+    } catch (Exception error) {
+      throw secureStorageException("getAllKeys", error);
+    }
+  }
+
+  public static void multiSet(Context context, ReadableArray pairs) throws Exception {
+    try {
+      SharedPreferences.Editor editor = getPreferences(context).edit();
+      for (int i = 0; i < pairs.size(); i++) {
+        ReadableArray pair = pairs.getArray(i);
+        if (pair != null && pair.size() == 2) {
+          editor.putString(namespacedKey(pair.getString(0)), pair.getString(1));
+        }
+      }
+      editor.apply();
+    } catch (Exception error) {
+      throw secureStorageException("multiSet", error);
+    }
+  }
+
+  public static WritableArray multiGet(Context context, ReadableArray keys) throws Exception {
+    try {
+      SharedPreferences prefs = getPreferences(context);
+      WritableArray result = Arguments.createArray();
+      for (int i = 0; i < keys.size(); i++) {
+        String key = keys.getString(i);
+        WritableArray pair = Arguments.createArray();
+        pair.pushString(key);
+        pair.pushString(prefs.getString(namespacedKey(key), null));
+        result.pushArray(pair);
+      }
+      return result;
+    } catch (Exception error) {
+      throw secureStorageException("multiGet", error);
+    }
+  }
+
+  public static void multiRemove(Context context, ReadableArray keys) throws Exception {
+    try {
+      SharedPreferences.Editor editor = getPreferences(context).edit();
+      for (int i = 0; i < keys.size(); i++) {
+        editor.remove(namespacedKey(keys.getString(i)));
+      }
+      editor.apply();
+    } catch (Exception error) {
+      throw secureStorageException("multiRemove", error);
+    }
+  }
+}

package/android/src/main/java/com/securitysuite/SecureView.java

@@ -3,8 +3,6 @@ package com.securitysuite;
 import android.app.Activity;
 import android.graphics.Color;
 import android.view.View;
-import android.view.Window;
-import android.view.WindowManager;
 import android.widget.FrameLayout;
 import android.content.Context;
 
@@ -34,10 +32,7 @@ public class SecureView extends FrameLayout {
       super.onAttachedToWindow();
       final Activity activity = reactContext.getCurrentActivity();
       if (activity != null) {
-        activity.runOnUiThread(() -> {
-          Window window = activity.getWindow();
-          window.addFlags(WindowManager.LayoutParams.FLAG_SECURE);
-        });
+        activity.runOnUiThread(() -> SecureWindowHelper.acquire(activity.getWindow()));
       }
   }
 
@@ -46,10 +41,7 @@ public class SecureView extends FrameLayout {
       super.onDetachedFromWindow();
       final Activity activity = reactContext.getCurrentActivity();
       if (activity != null) {
-        activity.runOnUiThread(() -> {
-          Window window = activity.getWindow();
-          window.clearFlags(WindowManager.LayoutParams.FLAG_SECURE);
-        });
+        activity.runOnUiThread(() -> SecureWindowHelper.release(activity.getWindow()));
       }
   }
 

package/android/src/main/java/com/securitysuite/SecureWindowHelper.java

@@ -0,0 +1,30 @@
+package com.securitysuite;
+
+import android.view.Window;
+import android.view.WindowManager;
+
+public final class SecureWindowHelper {
+  private static int refCount = 0;
+
+  private SecureWindowHelper() {}
+
+  public static synchronized void acquire(Window window) {
+    if (window == null) {
+      return;
+    }
+    if (refCount == 0) {
+      window.addFlags(WindowManager.LayoutParams.FLAG_SECURE);
+    }
+    refCount++;
+  }
+
+  public static synchronized void release(Window window) {
+    if (window == null) {
+      return;
+    }
+    refCount = Math.max(0, refCount - 1);
+    if (refCount == 0) {
+      window.clearFlags(WindowManager.LayoutParams.FLAG_SECURE);
+    }
+  }
+}