wallet-stack 1.0.0-alpha.121

package/src/pincode/authentication.ts

@@ -0,0 +1,425 @@
+/**
+ * Logic and utilities for managing account secrets
+ * The pincode is a short numeric string the user is required to enter
+ * The pepper is a generated once per account and stored in the keychain/keystore
+ * The password is a combination of the two. It is used for unlocking the account in the keychain
+ */
+
+import * as Keychain from '@divvi/react-native-keychain'
+import crypto from 'crypto'
+import { PincodeType } from 'src/account/reducer'
+import { pincodeTypeSelector } from 'src/account/selectors'
+import AppAnalytics from 'src/analytics/AppAnalytics'
+import { AuthenticationEvents, OnboardingEvents } from 'src/analytics/Events'
+import { ErrorMessages } from 'src/app/ErrorMessages'
+import { getStoredMnemonic, storeMnemonic } from 'src/backup/utils'
+import i18n from 'src/i18n'
+import { storedPasswordRefreshed } from 'src/identity/actions'
+import { shouldRefreshStoredPasswordHashSelector } from 'src/identity/selectors'
+import { navigate, navigateBack } from 'src/navigator/NavigationService'
+import { Screens } from 'src/navigator/Screens'
+import {
+  clearPasswordCaches,
+  getCachedPassword,
+  getCachedPasswordHash,
+  getCachedPepper,
+  getCachedPin,
+  setCachedPassword,
+  setCachedPasswordHash,
+  setCachedPepper,
+  setCachedPin,
+} from 'src/pincode/PasswordCache'
+import { store } from 'src/redux/store'
+import {
+  isUserCancelledError,
+  removeStoredItem,
+  retrieveStoredItem,
+  storeItem,
+} from 'src/storage/keychain'
+import Logger from 'src/utils/Logger'
+import { isValidAddress, normalizeAddress } from 'src/utils/address'
+import { ensureError } from 'src/utils/ensureError'
+import { sleep } from 'src/utils/sleep'
+import { UNLOCK_DURATION } from 'src/web3/consts'
+import { getKeychainAccounts } from 'src/web3/contracts'
+import { call, select } from 'typed-redux-saga'
+import { sha256 } from 'viem'
+
+const TAG = 'pincode/authentication'
+
+enum STORAGE_KEYS {
+  PEPPER = 'PEPPER',
+  PASSWORD_HASH = 'PASSWORD_HASH',
+  PIN = 'PIN',
+  SIGNED_MESSAGE = 'SIGNED_MESSAGE',
+}
+
+const PEPPER_LENGTH = 64
+export const PIN_LENGTH = 6
+// Pepper and pin not currently generalized to be per account
+// Using this value in the caches
+export const DEFAULT_CACHE_ACCOUNT = 'default'
+export const CANCELLED_PIN_INPUT = 'CANCELLED_PIN_INPUT'
+export const BIOMETRY_VERIFICATION_DELAY = 800
+
+const DEPRECATED_PIN_BLOCKLIST = [
+  '000000',
+  '111111',
+  '222222',
+  '333333',
+  '444444',
+  '555555',
+  '666666',
+  '777777',
+  '888888',
+  '999999',
+  '123456',
+  '654321',
+]
+
+export function isPinValid(pin: string) {
+  return /^\d{6}$/.test(pin) && !DEPRECATED_PIN_BLOCKLIST.includes(pin)
+}
+
+export async function retrieveOrGeneratePepper(account = DEFAULT_CACHE_ACCOUNT) {
+  if (!getCachedPepper(account)) {
+    let storedPepper = await retrieveStoredItem(STORAGE_KEYS.PEPPER)
+    if (!storedPepper) {
+      Logger.debug(TAG, 'No stored pepper, generating new pepper and storing it to the keychain')
+      const randomBytes = crypto.randomBytes(PEPPER_LENGTH)
+      const pepper = randomBytes.toString('hex')
+      await storeItem({ key: STORAGE_KEYS.PEPPER, value: pepper })
+      storedPepper = pepper
+    }
+    setCachedPepper(account, storedPepper)
+  }
+  return getCachedPepper(account)!
+}
+
+async function getPasswordForPin(pin: string) {
+  const pepper = await retrieveOrGeneratePepper()
+  const password = `${pepper}${pin}`
+  return password
+}
+
+async function getPasswordHashForPin(pin: string) {
+  const password = await getPasswordForPin(pin)
+  return getPasswordHash(password)
+}
+
+// TODO: this existing implementation implies password is in hex (no '0x' prefix)
+// but we should lift that restriction as it's too easy to misuse
+function getPasswordHash(password: string): string {
+  return sha256(Buffer.from(password, 'hex')).slice(2)
+}
+
+// for testing
+export const _getPasswordHash = getPasswordHash
+
+export function passwordHashStorageKey(account: string) {
+  if (!isValidAddress(account)) {
+    throw new Error('Expecting valid address for computing storage key')
+  }
+  return `${STORAGE_KEYS.PASSWORD_HASH}-${normalizeAddress(account)}`
+}
+
+function storePasswordHash(hash: string, account: string) {
+  setCachedPasswordHash(account, hash)
+  return storeItem({ key: passwordHashStorageKey(account), value: hash })
+}
+
+function storePinWithBiometry(pin: string) {
+  return storeItem({
+    key: STORAGE_KEYS.PIN,
+    value: pin,
+    options: {
+      accessControl: Keychain.ACCESS_CONTROL.BIOMETRY_CURRENT_SET,
+      accessible: Keychain.ACCESSIBLE.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
+      securityLevel: Keychain.SECURITY_LEVEL.SECURE_SOFTWARE,
+    },
+  })
+}
+
+export async function storeSignedMessage(message: string) {
+  return storeItem({
+    key: STORAGE_KEYS.SIGNED_MESSAGE,
+    value: message,
+    options: {
+      accessible: Keychain.ACCESSIBLE.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
+    },
+  })
+}
+
+export async function retrieveSignedMessage() {
+  return retrieveStoredItem(STORAGE_KEYS.SIGNED_MESSAGE)
+}
+
+export function removeStoredPin() {
+  return removeStoredItem(STORAGE_KEYS.PIN)
+}
+
+async function retrievePasswordHash(account: string) {
+  if (!getCachedPasswordHash(account)) {
+    let hash: string | null = null
+    try {
+      hash = await retrieveStoredItem(passwordHashStorageKey(account))
+    } catch (err) {
+      Logger.error(`${TAG}@retrievePasswordHash`, 'Error retrieving hash', err, true)
+      return null
+    }
+    if (!hash) {
+      Logger.warn(`${TAG}@retrievePasswordHash`, 'No password hash found in store')
+      return null
+    }
+    setCachedPasswordHash(account, hash)
+  }
+  return getCachedPasswordHash(account)
+}
+
+let passwordLock = false
+let lastPassword: string | null = null
+let lastError: any = null
+
+export async function getPassword(
+  account: string,
+  withVerification: boolean = true,
+  storeHash: boolean = false
+) {
+  while (passwordLock) {
+    await sleep(100)
+    if (lastPassword) {
+      return lastPassword
+    }
+    if (lastError) {
+      throw lastError
+    }
+  }
+  passwordLock = true
+  try {
+    let password = getCachedPassword(account)
+    if (password) {
+      passwordLock = false
+      return password
+    }
+
+    AppAnalytics.track(AuthenticationEvents.get_pincode_start)
+    const pin = await getPincode(withVerification)
+    AppAnalytics.track(AuthenticationEvents.get_pincode_complete)
+    password = await getPasswordForPin(pin)
+
+    if (storeHash) {
+      const hash = getPasswordHash(password)
+      await storePasswordHash(hash, account)
+    }
+
+    setCachedPassword(account, password)
+    lastPassword = password
+    return password
+  } catch (error) {
+    lastError = error
+    throw error
+  } finally {
+    setTimeout(() => {
+      passwordLock = false
+      lastPassword = null
+      lastError = null
+    }, 500)
+  }
+}
+
+export function* getPasswordSaga(account: string, withVerification?: boolean, storeHash?: boolean) {
+  const pincodeType = yield* select(pincodeTypeSelector)
+
+  if (pincodeType === PincodeType.Unset) {
+    Logger.debug(TAG + '@getPincode', 'Pin has never been set')
+    AppAnalytics.track(OnboardingEvents.pin_never_set)
+    throw Error('Pin has never been set')
+  }
+
+  if (pincodeType !== PincodeType.CustomPin && pincodeType !== PincodeType.PhoneAuth) {
+    throw new Error(`Unsupported Pincode Type ${pincodeType}`)
+  }
+
+  return yield* call(getPassword, account, withVerification, storeHash)
+}
+
+type PinCallback = (pin: string) => void
+
+export async function setPincodeWithBiometry() {
+  let pin = getCachedPin(DEFAULT_CACHE_ACCOUNT)
+  if (!pin) {
+    pin = await requestPincodeInput(true, true)
+  }
+
+  try {
+    // storeItem can be called multiple times with the same key, so stale keys
+    // from previous app installs/failed save attempts will be overwritten
+    // safely here
+    await storePinWithBiometry(pin)
+    // allow native biometry verification animation to run fully
+    await sleep(BIOMETRY_VERIFICATION_DELAY)
+  } catch (error) {
+    Logger.warn(TAG, 'Failed to save pin with biometry', error)
+    throw error
+  }
+}
+
+export async function getPincodeWithBiometry() {
+  try {
+    AppAnalytics.track(AuthenticationEvents.get_pincode_with_biometry_start)
+    const retrievedPin = await retrieveStoredItem(STORAGE_KEYS.PIN, {
+      // only displayed on Android - would be displayed on iOS too if we allow
+      // device pincode fallback
+      authenticationPrompt: {
+        title: i18n.t('unlockWithBiometryPrompt') ?? undefined,
+      },
+      accessControl: Keychain.ACCESS_CONTROL.BIOMETRY_CURRENT_SET,
+    })
+    if (retrievedPin) {
+      AppAnalytics.track(AuthenticationEvents.get_pincode_with_biometry_complete)
+      setCachedPin(DEFAULT_CACHE_ACCOUNT, retrievedPin)
+      // allow native biometry verification animation to run fully
+      await sleep(BIOMETRY_VERIFICATION_DELAY)
+      return retrievedPin
+    }
+    throw new Error('Failed to retrieve pin with biometry, recieved null value')
+  } catch (error) {
+    AppAnalytics.track(AuthenticationEvents.get_pincode_with_biometry_error)
+    Logger.warn(TAG, 'Failed to retrieve pin with biometry', error)
+    throw error
+  }
+}
+
+// Retrieve the pincode value
+// May trigger the pincode enter screen
+export async function getPincode(withVerification = true) {
+  const cachedPin = getCachedPin(DEFAULT_CACHE_ACCOUNT)
+  if (cachedPin) {
+    return cachedPin
+  }
+
+  const pincodeType = pincodeTypeSelector(store.getState())
+  if (pincodeType === PincodeType.PhoneAuth) {
+    try {
+      const retrievedPin = await getPincodeWithBiometry()
+      return retrievedPin
+    } catch (err) {
+      const error = ensureError(err)
+      // do not return here, the pincode input is the user's fallback if
+      // biometric auth fails
+      if (!isUserCancelledError(error)) {
+        Logger.warn(TAG, 'Failed to retrieve pin with biometry', error)
+      }
+    }
+  }
+
+  const pin = await requestPincodeInput(withVerification, true)
+  return pin
+}
+
+// Navigate to the pincode enter screen and check pin
+export async function requestPincodeInput(
+  withVerification = true,
+  shouldNavigateBack = true,
+  account?: string
+) {
+  const pin = await new Promise((resolve: PinCallback, reject: (error: string) => void) => {
+    navigate(Screens.PincodeEnter, {
+      onSuccess: resolve,
+      onCancel: () => reject(CANCELLED_PIN_INPUT),
+      withVerification,
+      account,
+    })
+  })
+
+  if (shouldNavigateBack) {
+    navigateBack()
+  }
+
+  if (!pin) {
+    throw new Error('Pincode confirmation returned empty pin')
+  }
+
+  setCachedPin(DEFAULT_CACHE_ACCOUNT, pin)
+  return pin
+}
+
+// Confirm pin is correct by checking it against the stored password hash
+export async function checkPin(pin: string, account: string) {
+  const shouldRefreshStoredPasswordHash = shouldRefreshStoredPasswordHashSelector(store.getState())
+
+  const hashForPin = await getPasswordHashForPin(pin)
+  const correctHash = await retrievePasswordHash(account)
+
+  if (!correctHash || shouldRefreshStoredPasswordHash) {
+    Logger.warn(`${TAG}@checkPin`, 'Validating pin without stored password hash')
+    const password = await getPasswordForPin(pin)
+    const unlocked = await ensureCorrectPassword(password, account)
+    if (unlocked) {
+      await storePasswordHash(hashForPin, account)
+      store.dispatch(storedPasswordRefreshed())
+
+      return true
+    }
+    return false
+  }
+
+  return hashForPin === correctHash
+}
+
+export async function updatePin(account: string, oldPin: string, newPin: string) {
+  try {
+    const accounts = await getKeychainAccounts()
+    const oldPassword = await getPasswordForPin(oldPin)
+    const newPassword = await getPasswordForPin(newPin)
+    const updated = await accounts.updatePassphrase(account, oldPassword, newPassword)
+    if (updated) {
+      clearPasswordCaches()
+      setCachedPin(DEFAULT_CACHE_ACCOUNT, newPin)
+      const hash = getPasswordHash(newPassword)
+      await storePasswordHash(hash, account)
+      const pincodeType = pincodeTypeSelector(store.getState())
+      if (pincodeType === PincodeType.PhoneAuth) {
+        await storePinWithBiometry(newPin)
+      }
+      const phrase = await getStoredMnemonic(account, oldPassword)
+      if (phrase) {
+        await storeMnemonic(phrase, account, newPassword)
+      } else {
+        throw new Error("Couldn't find stored mnemonic")
+      }
+      return true
+    }
+  } catch (error) {
+    Logger.error(`${TAG}@updatePin`, 'Error updating pin', error)
+    return false
+  }
+}
+
+// Confirm password by actually attempting to unlock the account
+export async function ensureCorrectPassword(
+  password: string,
+  currentAccount: string
+): Promise<boolean> {
+  try {
+    const accounts = await getKeychainAccounts()
+    const result = await accounts.unlock(currentAccount, password, UNLOCK_DURATION)
+    return result
+  } catch (error) {
+    Logger.error(TAG, 'Error attempting to unlock wallet', error, true)
+    Logger.showError(
+      i18n.t(ErrorMessages.ACCOUNT_UNLOCK_FAILED) ?? new Error('Error attempting to unlock wallet')
+    )
+    return false
+  }
+}
+
+export async function removeAccountLocally(account: string) {
+  clearPasswordCaches()
+  return Promise.all([
+    removeStoredItem(STORAGE_KEYS.PEPPER),
+    removeStoredItem(passwordHashStorageKey(account)),
+    removeStoredItem(STORAGE_KEYS.PIN),
+    removeStoredItem(STORAGE_KEYS.SIGNED_MESSAGE),
+  ])
+}

package/src/points/ActivityCard.test.tsx

@@ -0,0 +1,63 @@
+import { fireEvent, render } from '@testing-library/react-native'
+import React from 'react'
+import { PointsEvents } from 'src/analytics/Events'
+import AppAnalytics from 'src/analytics/AppAnalytics'
+import SwapArrows from 'src/icons/SwapArrows'
+import ActivityCard, { Props } from './ActivityCard'
+
+jest.mock('src/analytics/AppAnalytics')
+
+const mockProps: Props = {
+  activityId: 'swap',
+  pointsAmount: 20,
+  previousPointsAmount: 10,
+  completed: false,
+  title: 'Swap',
+  icon: <SwapArrows testID="SwapArrowsIcon" />,
+  onPress: jest.fn(),
+}
+
+describe('ActivityCard', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+  })
+
+  it('renders correctly', () => {
+    const { getByText, getByTestId } = render(<ActivityCard {...mockProps} />)
+
+    expect(getByText('Swap')).toBeTruthy()
+    expect(getByText('20')).toBeTruthy()
+    expect(getByText('10')).toBeTruthy()
+    expect(getByTestId('SwapArrowsIcon')).toBeTruthy()
+  })
+
+  it('renders correcly when completed', () => {
+    const completedProps = { ...mockProps, completed: true }
+    const { getByTestId } = render(<ActivityCard {...completedProps} />)
+
+    const card = getByTestId('ActivityCard/swap')
+    expect(card).toBeDisabled()
+    expect(card.props.style).toContainEqual({ opacity: 0.5 })
+    expect(getByTestId('CheckCircleIcon')).toBeTruthy()
+  })
+
+  it('handles press correctly', () => {
+    const { getByText } = render(<ActivityCard {...mockProps} />)
+
+    fireEvent.press(getByText('Swap'))
+    expect(AppAnalytics.track).toHaveBeenCalledWith(PointsEvents.points_screen_card_press, {
+      activityId: 'swap',
+    })
+    expect(mockProps.onPress).toHaveBeenCalled()
+  })
+
+  it('tracks analytics event even when no press handler provided', () => {
+    const noPressProps = { ...mockProps, onPress: undefined }
+    const { getByText } = render(<ActivityCard {...noPressProps} />)
+
+    fireEvent.press(getByText('Swap'))
+    expect(AppAnalytics.track).toHaveBeenCalledWith(PointsEvents.points_screen_card_press, {
+      activityId: 'swap',
+    })
+  })
+})

package/src/points/ActivityCard.tsx

@@ -0,0 +1,101 @@
+import React, { ReactNode } from 'react'
+import { useTranslation } from 'react-i18next'
+import { StyleSheet, Text, View } from 'react-native'
+import AppAnalytics from 'src/analytics/AppAnalytics'
+import { PointsEvents } from 'src/analytics/Events'
+import Touchable from 'src/components/Touchable'
+import CheckCircle from 'src/icons/CheckCircle'
+import ComingSoon from 'src/icons/ComingSoon'
+import LogoHeart from 'src/images/LogoHeart'
+import { PointsActivity } from 'src/points/types'
+import Colors from 'src/styles/colors'
+import { typeScale } from 'src/styles/fonts'
+import { Spacing } from 'src/styles/styles'
+
+export interface Props extends PointsActivity {
+  title: string
+  icon: ReactNode
+  onPress?: () => void
+}
+
+export default function ActivityCard({
+  activityId,
+  pointsAmount,
+  previousPointsAmount,
+  completed = false,
+  title,
+  icon,
+  onPress,
+}: Props) {
+  const handleOnPress = () => {
+    AppAnalytics.track(PointsEvents.points_screen_card_press, { activityId })
+    onPress?.()
+  }
+
+  return (
+    <Touchable
+      testID={`ActivityCard/${activityId}`}
+      style={[styles.card, completed && styles.faded]}
+      borderRadius={Spacing.Smallest8}
+      disabled={completed}
+      onPress={handleOnPress}
+    >
+      <>
+        {completed ? <CheckCircle testID="CheckCircleIcon" /> : icon}
+        <Text style={styles.cardTitle}>{title}</Text>
+        <View style={styles.pointsAmountContainer}>
+          <Text style={styles.previousPointsAmount}>{previousPointsAmount}</Text>
+          <Text style={styles.pointsAmount}>{pointsAmount}</Text>
+          <LogoHeart size={Spacing.Regular16} />
+        </View>
+      </>
+    </Touchable>
+  )
+}
+
+export function MoreComingCard() {
+  const { t } = useTranslation()
+
+  return (
+    <View style={styles.card}>
+      <ComingSoon />
+      <Text style={styles.cardTitle}>{t('points.activityCards.moreComing.title')}</Text>
+    </View>
+  )
+}
+
+const styles = StyleSheet.create({
+  cardTitle: {
+    flex: 1,
+    ...typeScale.labelSmall,
+  },
+  card: {
+    backgroundColor: Colors.backgroundSecondary,
+    flexDirection: 'row',
+    alignItems: 'center',
+    padding: Spacing.Regular16,
+    gap: Spacing.Smallest8,
+    borderRadius: Spacing.Smallest8,
+  },
+  faded: {
+    opacity: 0.5,
+  },
+  pointsAmountContainer: {
+    marginLeft: 'auto',
+    flexDirection: 'row',
+    borderRadius: 100,
+    borderWidth: 1,
+    borderColor: Colors.borderPrimary,
+    paddingHorizontal: Spacing.Smallest8,
+    paddingVertical: Spacing.Tiny4,
+    gap: Spacing.Tiny4,
+  },
+  pointsAmount: {
+    ...typeScale.labelXSmall,
+  },
+  previousPointsAmount: {
+    ...typeScale.labelXSmall,
+    color: Colors.contentSecondary,
+    textDecorationLine: 'line-through',
+  },
+})