Bluesky OAuth Client

metro.config.js

@@ -1,7 +1,47 @@
 // Learn more https://docs.expo.io/guides/customizing-metro
+const path = require('path')
 const {getDefaultConfig} = require('expo/metro-config')
 const cfg = getDefaultConfig(__dirname)
 
+if (process.env.ATPROTO_ROOT) {
+  const atprotoRoot = path.resolve(process.cwd(), process.env.ATPROTO_ROOT)
+
+  // Watch folders are used as roots for the virtual file system. Any file that
+  // needs to be resolved by the metro bundler must be within one of the watch
+  // folders. Since we will be resolving dependencies from the atproto packages,
+  // we need to add the atproto root to the watch folders so that the
+  cfg.watchFolders ||= []
+  cfg.watchFolders.push(atprotoRoot)
+
+  const resolveRequest = cfg.resolver.resolveRequest
+  cfg.resolver.resolveRequest = (context, moduleName, platform) => {
+    // Alias @atproto/* modules to the corresponding package in the atproto root
+    if (moduleName.startsWith('@atproto/')) {
+      const [, packageName] = moduleName.split('/', 2)
+      const packagePath = path.join(atprotoRoot, 'packages', packageName)
+      return context.resolveRequest(context, packagePath, platform)
+    }
+
+    // Polyfills are added by the build process and are not actual dependencies
+    // of the @atproto/* packages. Resolve those from here.
+    if (
+      moduleName.startsWith('@babel/') &&
+      context.originModulePath.startsWith(atprotoRoot)
+    ) {
+      return {
+        type: 'sourceFile',
+        filePath: require.resolve(moduleName),
+      }
+    }
+
+    return (resolveRequest || context.resolveRequest)(
+      context,
+      moduleName,
+      platform,
+    )
+  }
+}
+
 cfg.resolver.sourceExts = process.env.RN_SRC_EXT
   ? process.env.RN_SRC_EXT.split(',').concat(cfg.resolver.sourceExts)
   : cfg.resolver.sourceExts

modules/expo-bluesky-oauth-client/android/build.gradle

@@ -0,0 +1,93 @@
+apply plugin: 'com.android.library'
+apply plugin: 'kotlin-android'
+apply plugin: 'maven-publish'
+
+group = 'expo.modules.blueskyoauthclient'
+version = '0.0.1'
+
+buildscript {
+  def expoModulesCorePlugin = new File(project(":expo-modules-core").projectDir.absolutePath, "ExpoModulesCorePlugin.gradle")
+  if (expoModulesCorePlugin.exists()) {
+    apply from: expoModulesCorePlugin
+    applyKotlinExpoModulesCorePlugin()
+  }
+
+  // Simple helper that allows the root project to override versions declared by this library.
+  ext.safeExtGet = { prop, fallback ->
+    rootProject.ext.has(prop) ? rootProject.ext.get(prop) : fallback
+  }
+
+  // Ensures backward compatibility
+  ext.getKotlinVersion = {
+    if (ext.has("kotlinVersion")) {
+      ext.kotlinVersion()
+    } else {
+      ext.safeExtGet("kotlinVersion", "1.8.10")
+    }
+  }
+
+  repositories {
+    mavenCentral()
+  }
+
+  dependencies {
+    classpath("org.jetbrains.kotlin:kotlin-gradle-plugin:${getKotlinVersion()}")
+  }
+}
+
+afterEvaluate {
+  publishing {
+    publications {
+      release(MavenPublication) {
+        from components.release
+      }
+    }
+    repositories {
+      maven {
+        url = mavenLocal().url
+      }
+    }
+  }
+}
+
+android {
+  compileSdkVersion safeExtGet("compileSdkVersion", 33)
+
+  def agpVersion = com.android.Version.ANDROID_GRADLE_PLUGIN_VERSION
+  if (agpVersion.tokenize('.')[0].toInteger() < 8) {
+    compileOptions {
+      sourceCompatibility JavaVersion.VERSION_11
+      targetCompatibility JavaVersion.VERSION_11
+    }
+
+    kotlinOptions {
+      jvmTarget = JavaVersion.VERSION_11.majorVersion
+    }
+  }
+
+  namespace "expo.modules.blueskyoauthclient"
+  defaultConfig {
+    minSdkVersion safeExtGet("minSdkVersion", 21)
+    targetSdkVersion safeExtGet("targetSdkVersion", 34)
+    versionCode 1
+    versionName "0.0.1"
+  }
+  lintOptions {
+    abortOnError false
+  }
+  publishing {
+    singleVariant("release") {
+      withSourcesJar()
+    }
+  }
+}
+
+repositories {
+  mavenCentral()
+}
+
+dependencies {
+  implementation project(':expo-modules-core')
+  implementation "org.jetbrains.kotlin:kotlin-stdlib-jdk7:${getKotlinVersion()}"
+  implementation "com.nimbusds:nimbus-jose-jwt:9.38-rc3"
+}

modules/expo-bluesky-oauth-client/android/src/main/AndroidManifest.xml

@@ -0,0 +1,2 @@
+<manifest>
+</manifest>

modules/expo-bluesky-oauth-client/android/src/main/java/expo/modules/blueskyoauthclient/CryptoUtil.kt

@@ -0,0 +1,52 @@
+package expo.modules.blueskyoauthclient
+
+import com.nimbusds.jose.Algorithm
+import java.security.KeyPairGenerator
+import java.security.MessageDigest
+import java.security.interfaces.ECPublicKey
+import java.security.interfaces.ECPrivateKey
+import com.nimbusds.jose.jwk.Curve
+import com.nimbusds.jose.jwk.ECKey
+import com.nimbusds.jose.jwk.KeyUse
+import java.util.UUID
+
+class CryptoUtil {
+  fun digest(data: ByteArray): ByteArray {
+    val digest = MessageDigest.getInstance("sha256")
+    return digest.digest(data)
+  }
+
+  fun getRandomValues(byteLength: Int): ByteArray {
+    val random = ByteArray(byteLength)
+    java.security.SecureRandom().nextBytes(random)
+    return random
+  }
+
+  fun generateKeyPair(): Map<String, String> {
+    val keyIdString = UUID.randomUUID().toString()
+
+    val keyPairGen = KeyPairGenerator.getInstance("EC")
+    keyPairGen.initialize(Curve.P_256.toECParameterSpec())
+    val keyPair = keyPairGen.generateKeyPair()
+
+    val publicKey = keyPair.public as ECPublicKey
+    val privateKey = keyPair.private as ECPrivateKey
+
+    val publicJwk = ECKey.Builder(Curve.P_256, publicKey)
+      .keyUse(KeyUse.SIGNATURE)
+      .algorithm(Algorithm.parse("ES256"))
+      .keyID(keyIdString)
+      .build()
+    val privateJwk = ECKey.Builder(Curve.P_256, publicKey)
+      .privateKey(privateKey)
+      .keyUse(KeyUse.SIGNATURE)
+      .keyID(keyIdString)
+      .algorithm(Algorithm.parse("ES256"))
+      .build()
+
+    return mapOf(
+      "privateKey" to privateJwk.toJSONString(),
+      "publicKey" to publicJwk.toJSONString()
+    )
+  }
+}

modules/expo-bluesky-oauth-client/android/src/main/java/expo/modules/blueskyoauthclient/ExpoBlueskyOAuthClientModule.kt

@@ -0,0 +1,35 @@
+package expo.modules.blueskyoauthclient
+
+import android.util.Log
+import expo.modules.kotlin.modules.Module
+import expo.modules.kotlin.modules.ModuleDefinition
+
+class ExpoBlueskyOAuthClientModule : Module() {
+  override fun definition() = ModuleDefinition {
+    Name("ExpoBlueskyOAuthClient")
+
+    AsyncFunction("digest") { value: ByteArray, algorithmName: String ->
+      if(algorithmName != "sha256") throw Exception("Unsupported algorithm")
+      return@AsyncFunction CryptoUtil().digest(value)
+    }
+
+    Function("getRandomValues") { byteLength: Int ->
+      return@Function CryptoUtil().getRandomValues(byteLength)
+    }
+
+    AsyncFunction("generateJwk") { algorithim: String? ->
+      if (algorithim != "ES256") {
+        throw Exception("Unsupported algorithm")
+      }
+      return@AsyncFunction CryptoUtil().generateKeyPair()
+    }
+
+    AsyncFunction("createJwt") { header: String, payload: String, jwk: String ->
+      return@AsyncFunction JWTUtil().createJwt(header, payload, jwk)
+    }
+
+    AsyncFunction("verifyJwt") { token: String, jwk: String ->
+      return@AsyncFunction JWTUtil().verifyJwt(token, jwk)
+    }
+  }
+}

modules/expo-bluesky-oauth-client/android/src/main/java/expo/modules/blueskyoauthclient/JWK.kt

@@ -0,0 +1,9 @@
+package expo.modules.blueskyoauthclient
+
+import expo.modules.kotlin.records.Record
+import expo.modules.kotlin.records.Field
+
+class JWKPair(
+  @Field val privateKey: String,
+  @Field val publicKey: String
+) : Record

modules/expo-bluesky-oauth-client/android/src/main/java/expo/modules/blueskyoauthclient/JWT.kt

@@ -0,0 +1,9 @@
+package expo.modules.blueskyoauthclient
+
+import expo.modules.kotlin.records.Record
+import expo.modules.kotlin.records.Field
+
+class JWTVerifyResponse(
+  @Field var protectedHeader: String,
+  @Field var payload: String,
+) : Record

modules/expo-bluesky-oauth-client/android/src/main/java/expo/modules/blueskyoauthclient/JWTUtil.kt

@@ -0,0 +1,44 @@
+package expo.modules.blueskyoauthclient
+
+import com.nimbusds.jose.JWSHeader
+import com.nimbusds.jose.crypto.ECDSASigner
+import com.nimbusds.jose.crypto.ECDSAVerifier
+import com.nimbusds.jose.jwk.ECKey
+import com.nimbusds.jwt.JWTClaimsSet
+import com.nimbusds.jwt.SignedJWT
+
+class JWTUtil {
+  fun createJwt(header: String, payload: String, jwk: String): String {
+    val parsedKey = ECKey.parse(jwk)
+    val parsedHeader = JWSHeader.parse(header)
+    val parsedPayload = JWTClaimsSet.parse(payload)
+
+    val signer = ECDSASigner(parsedKey)
+    val jwt = SignedJWT(parsedHeader, parsedPayload)
+    jwt.sign(signer)
+
+    return jwt.serialize()
+  }
+
+  fun verifyJwt(token: String, jwk: String): Map<String, String> {
+    try {
+      val parsedKey = ECKey.parse(jwk)
+      val jwt = SignedJWT.parse(token)
+      val verifier = ECDSAVerifier(parsedKey)
+
+      if (!jwt.verify(verifier)) {
+        throw Exception("Invalid signature")
+      }
+
+      val header = jwt.header
+      val payload = jwt.payload
+
+      return mapOf(
+        "payload" to payload.toString(),
+        "protectedHeader" to header.toString()
+      )
+    } catch(e: Exception) {
+      throw e
+    }
+  }
+}

modules/expo-bluesky-oauth-client/expo-module.config.json

@@ -0,0 +1,9 @@
+{
+  "platforms": ["ios", "tvos", "android", "web"],
+  "ios": {
+    "modules": ["ExpoBlueskyOAuthClientModule"]
+  },
+  "android": {
+    "modules": ["expo.modules.blueskyoauthclient.ExpoBlueskyOAuthClientModule"]
+  }
+}

modules/expo-bluesky-oauth-client/index.ts

@@ -0,0 +1,4 @@
+export * from './src/oauth-client-react-native'
+export * from './src/react-native-crypto-implementation'
+export * from './src/react-native-key'
+export * from './src/react-native-store-with-key'

modules/expo-bluesky-oauth-client/ios/CryptoUtil.swift

@@ -0,0 +1,50 @@
+import CryptoKit
+import JOSESwift
+import ExpoModulesCore
+
+class CryptoUtil {
+  // The equivalent of crypto.subtle.digest() with JS on web
+  public static func digest(data: Data) -> Data {
+    let hash = SHA256.hash(data: data)
+    return Data(hash)
+  }
+
+  public static func getRandomValues(byteLength: Int) -> Data {
+    let bytes = (0..<byteLength).map { _ in UInt8.random(in: UInt8.min...UInt8.max) }
+    return Data(bytes)
+  }
+
+  public static func generateKeyPair() throws -> [String:String] {
+    let keyIdString = UUID().uuidString
+
+    let privateKey = P256.Signing.PrivateKey()
+    let publicKey = privateKey.publicKey
+
+    let x = publicKey.x963Representation[1..<33].base64URLEncodedString()
+    let y = publicKey.x963Representation[33...].base64URLEncodedString()
+    let d = privateKey.rawRepresentation.base64URLEncodedString()
+
+    let publicJWK = JWK(kty: "EC", use: "sig", crv: "P-256", kid: keyIdString, x: x, y: y, alg: "ES256")
+    let privateJWK = JWK(kty: "EC", use: "sig", crv: "P-256", kid: keyIdString, x: x, y: y, d: d, alg: "ES256")
+
+    return [
+      "privateKey": privateJWK.toJson(),
+      "publicKey": publicJWK.toJson()
+    ]
+  }
+}
+
+extension Data {
+  func base64URLEncodedString() -> String {
+    return self.base64EncodedString().replacingOccurrences(of: "+", with: "-").replacingOccurrences(of: "/", with: "_").replacingOccurrences(of: "=", with: "")
+  }
+}
+
+extension String {
+  func toField() -> Field<String> {
+    return Field(wrappedValue: self)
+  }
+  func toNullableField() -> Field<String?> {
+    return Field(wrappedValue: self)
+  }
+}

modules/expo-bluesky-oauth-client/ios/ExpoBlueskyOAuthClient.podspec

@@ -0,0 +1,22 @@
+Pod::Spec.new do |s|
+  s.name           = 'ExpoBlueskyOAuthClient'
+  s.version        = '0.0.1'
+  s.summary        = 'A library of native functions to support Bluesky OAuth in React Native.'
+  s.description    = 'A library of native functions to support Bluesky OAuth in React Native.'
+  s.author         = ''
+  s.homepage       = 'https://github.com/bluesky-social/social-app'
+  s.platforms      = { :ios => '13.4', :tvos => '13.4' }
+  s.source         = { git: '' }
+  s.static_framework = true
+
+  s.dependency 'ExpoModulesCore'
+  s.dependency 'JOSESwift', '~> 2.3'
+
+  # Swift/Objective-C compatibility
+  s.pod_target_xcconfig = {
+    'DEFINES_MODULE' => 'YES',
+    'SWIFT_COMPILATION_MODE' => 'wholemodule'
+  }
+
+  s.source_files = "**/*.{h,m,mm,swift,hpp,cpp}"
+end