tauri-plugin-secure-element-api 0.1.0-alpha.1

package/README.md

@@ -0,0 +1,154 @@
+# Tauri Plugin Secure Element
+
+A Tauri plugin for secure element functionality on iOS (Secure Enclave) and Android (Strongbox and TEE).
+
+## Features
+
+- Generate secure keys using hardware-backed secure storage
+- Sign data with keys stored in secure elements
+- List and manage secure keys
+- Check secure element support on the device
+- Support for biometric and PIN authentication modes
+- Cross-platform support for iOS and Android
+
+## Installation
+
+### npm
+
+```bash
+npm install tauri-plugin-secure-element-api
+# or
+pnpm add tauri-plugin-secure-element-api
+# or
+yarn add tauri-plugin-secure-element-api
+```
+
+### Cargo
+
+```toml
+[dependencies]
+tauri-plugin-secure-element = "0.1.0"
+```
+
+## Setup
+
+Add the plugin to your `tauri.conf.json`:
+
+```json
+{
+  "plugins": {
+    "secure-element": {
+      "all": true
+    }
+  }
+}
+```
+
+## Usage
+
+```typescript
+import {
+  checkSecureElementSupport,
+  generateSecureKey,
+  listKeys,
+  signWithKey,
+  deleteKey,
+  type AuthenticationMode,
+} from "tauri-plugin-secure-element-api";
+
+// Check if secure element is supported
+const support = await checkSecureElementSupport();
+console.log("Secure element supported:", support.secureElementSupported);
+
+// Generate a new secure key
+const { publicKey, keyName } = await generateSecureKey(
+  "my-key-name",
+  "pinOrBiometric" // or 'none' or 'biometricOnly'
+);
+
+// List all keys
+const keys = await listKeys();
+
+// Sign data with a key
+const data = new Uint8Array([1, 2, 3, 4]);
+const signature = await signWithKey("my-key-name", data);
+
+// Delete a key
+await deleteKey("my-key-name");
+```
+
+## API Reference
+
+### `checkSecureElementSupport()`
+
+Returns information about secure element support on the device.
+
+**Returns:** `Promise<SecureElementSupport>`
+
+```typescript
+interface SecureElementSupport {
+  secureElementSupported: boolean;
+  teeSupported: boolean;
+  canEnforceBiometricOnly: boolean;
+}
+```
+
+### `generateSecureKey(keyName: string, authMode?: AuthenticationMode)`
+
+Generates a new secure key in the device's secure element.
+
+**Parameters:**
+
+- `keyName`: Unique name for the key
+- `authMode`: Authentication mode (`'none'`, `'pinOrBiometric'`, or `'biometricOnly'`)
+
+**Returns:** `Promise<{ publicKey: string; keyName: string }>`
+
+### `listKeys(keyName?: string, publicKey?: string)`
+
+Lists keys stored in the secure element. Can filter by key name or public key.
+
+**Returns:** `Promise<KeyInfo[]>`
+
+```typescript
+interface KeyInfo {
+  keyName: string;
+  publicKey: string;
+  requiresAuthentication?: boolean;
+}
+```
+
+### `signWithKey(keyName: string, data: Uint8Array)`
+
+Signs data using a key stored in the secure element.
+
+**Parameters:**
+
+- `keyName`: Name of the key to use
+- `data`: Data to sign as `Uint8Array`
+
+**Returns:** `Promise<Uint8Array>` - The signature
+
+### `deleteKey(keyName?: string, publicKey?: string)`
+
+Deletes a key from the secure element. At least one parameter must be provided.
+
+**Returns:** `Promise<boolean>` - Success status
+
+## Platform Support
+
+- **iOS**: Uses Secure Enclave for key generation and signing
+- **Android**: Uses Strongbox and TEE (Trusted Execution Environment) when available
+
+## License
+
+Apache-2.0
+
+## Contributing
+
+Contributions are welcome! Please feel free to submit a Pull Request.
+
+## Links
+
+- [Repository](https://github.com/dkackman/tauri-plugin-secure-element)
+- [Issues](https://github.com/dkackman/tauri-plugin-secure-element/issues)

package/dist-js/index.cjs

@@ -0,0 +1,58 @@
+'use strict';
+
+var core = require('@tauri-apps/api/core');
+
+async function ping(value) {
+    return await core.invoke("plugin:secure-element|ping", {
+        payload: {
+            value,
+        },
+    }).then((r) => (r.value ? r.value : null));
+}
+async function generateSecureKey(keyName, authMode = "pinOrBiometric") {
+    return await core.invoke("plugin:secure-element|generate_secure_key", {
+        payload: {
+            keyName,
+            authMode,
+        },
+    });
+}
+async function listKeys(keyName, publicKey) {
+    return await core.invoke("plugin:secure-element|list_keys", {
+        payload: {
+            keyName: keyName || null,
+            publicKey: publicKey || null,
+        },
+    }).then((r) => r.keys);
+}
+async function signWithKey(keyName, data) {
+    return await core.invoke("plugin:secure-element|sign_with_key", {
+        payload: {
+            keyName,
+            data: Array.from(data),
+        },
+    }).then((r) => new Uint8Array(r.signature));
+}
+/**
+ * Delete a key by name or by public key.
+ * At least one of keyName or publicKey must be provided.
+ */
+async function deleteKey(keyName, publicKey) {
+    return await core.invoke("plugin:secure-element|delete_key", {
+        payload: {
+            keyName: keyName || null,
+            publicKey: publicKey || null,
+        },
+    }).then((r) => r.success);
+}
+async function checkSecureElementSupport() {
+    const result = await core.invoke("plugin:secure-element|check_secure_element_support");
+    return result;
+}
+
+exports.checkSecureElementSupport = checkSecureElementSupport;
+exports.deleteKey = deleteKey;
+exports.generateSecureKey = generateSecureKey;
+exports.listKeys = listKeys;
+exports.ping = ping;
+exports.signWithKey = signWithKey;

package/dist-js/index.d.ts

@@ -0,0 +1,24 @@
+export interface KeyInfo {
+    keyName: string;
+    publicKey: string;
+    requiresAuthentication?: boolean;
+}
+export declare function ping(value: string): Promise<string | null>;
+export type AuthenticationMode = "none" | "pinOrBiometric" | "biometricOnly";
+export declare function generateSecureKey(keyName: string, authMode?: AuthenticationMode): Promise<{
+    publicKey: string;
+    keyName: string;
+}>;
+export declare function listKeys(keyName?: string, publicKey?: string): Promise<KeyInfo[]>;
+export declare function signWithKey(keyName: string, data: Uint8Array): Promise<Uint8Array>;
+/**
+ * Delete a key by name or by public key.
+ * At least one of keyName or publicKey must be provided.
+ */
+export declare function deleteKey(keyName?: string, publicKey?: string): Promise<boolean>;
+export interface SecureElementSupport {
+    secureElementSupported: boolean;
+    teeSupported: boolean;
+    canEnforceBiometricOnly: boolean;
+}
+export declare function checkSecureElementSupport(): Promise<SecureElementSupport>;

package/dist-js/index.js

@@ -0,0 +1,51 @@
+import { invoke } from '@tauri-apps/api/core';
+
+async function ping(value) {
+    return await invoke("plugin:secure-element|ping", {
+        payload: {
+            value,
+        },
+    }).then((r) => (r.value ? r.value : null));
+}
+async function generateSecureKey(keyName, authMode = "pinOrBiometric") {
+    return await invoke("plugin:secure-element|generate_secure_key", {
+        payload: {
+            keyName,
+            authMode,
+        },
+    });
+}
+async function listKeys(keyName, publicKey) {
+    return await invoke("plugin:secure-element|list_keys", {
+        payload: {
+            keyName: keyName || null,
+            publicKey: publicKey || null,
+        },
+    }).then((r) => r.keys);
+}
+async function signWithKey(keyName, data) {
+    return await invoke("plugin:secure-element|sign_with_key", {
+        payload: {
+            keyName,
+            data: Array.from(data),
+        },
+    }).then((r) => new Uint8Array(r.signature));
+}
+/**
+ * Delete a key by name or by public key.
+ * At least one of keyName or publicKey must be provided.
+ */
+async function deleteKey(keyName, publicKey) {
+    return await invoke("plugin:secure-element|delete_key", {
+        payload: {
+            keyName: keyName || null,
+            publicKey: publicKey || null,
+        },
+    }).then((r) => r.success);
+}
+async function checkSecureElementSupport() {
+    const result = await invoke("plugin:secure-element|check_secure_element_support");
+    return result;
+}
+
+export { checkSecureElementSupport, deleteKey, generateSecureKey, listKeys, ping, signWithKey };

package/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "tauri-plugin-secure-element-api",
+  "version": "0.1.0-alpha.1",
+  "description": "Tauri plugin for secure element use on iOS (Secure Enclave) and Android (Strongbox and TEE).",
+  "repository": "https://github.com/dkackman/tauri-plugin-secure-element",
+  "license": "Apache-2.0",
+  "author": "Don Kackman<dkackman@gmail.com>",
+  "homepage": "https://github.com/dkackman/tauri-plugin-secure-element",
+  "bugs": "https://github.com/dkackman/tauri-plugin-secure-element/issues",
+  "keywords": [
+    "tauri",
+    "tauri-plugin",
+    "secure-element",
+    "secure-enclave",
+    "strongbox",
+    "tee",
+    "cryptography",
+    "keychain",
+    "keystore",
+    "mobile",
+    "ios",
+    "android"
+  ],
+  "type": "module",
+  "types": "./dist-js/index.d.ts",
+  "main": "./dist-js/index.cjs",
+  "module": "./dist-js/index.js",
+  "exports": {
+    "types": "./dist-js/index.d.ts",
+    "import": "./dist-js/index.js",
+    "require": "./dist-js/index.cjs"
+  },
+  "files": [
+    "dist-js",
+    "README.md"
+  ],
+  "dependencies": {
+    "@tauri-apps/api": "^2.0.0"
+  },
+  "devDependencies": {
+    "@rollup/plugin-typescript": "^12.0.0",
+    "@naturalcycles/ktlint": "^1.16.0",
+    "prettier": "^3.7.4",
+    "rollup": "^4.9.6",
+    "typescript": "^5.3.3",
+    "tslib": "^2.6.2"
+  },
+  "scripts": {
+    "build": "rollup -c",
+    "pretest": "pnpm build",
+    "format": "prettier --write . && cargo fmt && swiftformat ios/ 2>/dev/null || echo 'Note: swiftformat not installed. Install with: brew install swiftformat' && pnpm format:kotlin",
+    "format:check": "prettier --check . && cargo fmt --check && (swiftformat --lint ios/ 2>/dev/null || echo 'Note: swiftformat not installed') && pnpm format:check:kotlin",
+    "format:js": "prettier --write .",
+    "format:rust": "cargo fmt",
+    "format:swift": "swiftformat ios/ || echo 'Note: swiftformat not installed. Install with: brew install swiftformat'",
+    "format:kotlin": "ktlint -F 'android/src/**/*.kt'",
+    "format:check:kotlin": "ktlint 'android/src/**/*.kt'",
+    "lint": "cargo clippy -- -D warnings && (swiftlint lint ios/ 2>/dev/null || (command -v swiftlint >/dev/null 2>&1 || echo 'Note: swiftlint not installed. Install with: brew install swiftlint')) && pnpm lint:kotlin",
+    "lint:rust": "cargo clippy -- -D warnings",
+    "lint:swift": "swiftlint lint ios/ || (command -v swiftlint >/dev/null 2>&1 || echo 'Note: swiftlint not installed. Install with: brew install swiftlint')",
+    "lint:kotlin": "ktlint 'android/src/**/*.kt'"
+  }
+}