Bluesky OAuth Client

modules/expo-bluesky-oauth-client/android/build.gradle

@@ -0,0 +1,93 @@
+apply plugin: 'com.android.library'
+apply plugin: 'kotlin-android'
+apply plugin: 'maven-publish'
+
+group = 'expo.modules.blueskyoauthclient'
+version = '0.0.1'
+
+buildscript {
+  def expoModulesCorePlugin = new File(project(":expo-modules-core").projectDir.absolutePath, "ExpoModulesCorePlugin.gradle")
+  if (expoModulesCorePlugin.exists()) {
+    apply from: expoModulesCorePlugin
+    applyKotlinExpoModulesCorePlugin()
+  }
+
+  // Simple helper that allows the root project to override versions declared by this library.
+  ext.safeExtGet = { prop, fallback ->
+    rootProject.ext.has(prop) ? rootProject.ext.get(prop) : fallback
+  }
+
+  // Ensures backward compatibility
+  ext.getKotlinVersion = {
+    if (ext.has("kotlinVersion")) {
+      ext.kotlinVersion()
+    } else {
+      ext.safeExtGet("kotlinVersion", "1.8.10")
+    }
+  }
+
+  repositories {
+    mavenCentral()
+  }
+
+  dependencies {
+    classpath("org.jetbrains.kotlin:kotlin-gradle-plugin:${getKotlinVersion()}")
+  }
+}
+
+afterEvaluate {
+  publishing {
+    publications {
+      release(MavenPublication) {
+        from components.release
+      }
+    }
+    repositories {
+      maven {
+        url = mavenLocal().url
+      }
+    }
+  }
+}
+
+android {
+  compileSdkVersion safeExtGet("compileSdkVersion", 33)
+
+  def agpVersion = com.android.Version.ANDROID_GRADLE_PLUGIN_VERSION
+  if (agpVersion.tokenize('.')[0].toInteger() < 8) {
+    compileOptions {
+      sourceCompatibility JavaVersion.VERSION_11
+      targetCompatibility JavaVersion.VERSION_11
+    }
+
+    kotlinOptions {
+      jvmTarget = JavaVersion.VERSION_11.majorVersion
+    }
+  }
+
+  namespace "expo.modules.blueskyoauthclient"
+  defaultConfig {
+    minSdkVersion safeExtGet("minSdkVersion", 21)
+    targetSdkVersion safeExtGet("targetSdkVersion", 34)
+    versionCode 1
+    versionName "0.0.1"
+  }
+  lintOptions {
+    abortOnError false
+  }
+  publishing {
+    singleVariant("release") {
+      withSourcesJar()
+    }
+  }
+}
+
+repositories {
+  mavenCentral()
+}
+
+dependencies {
+  implementation project(':expo-modules-core')
+  implementation "org.jetbrains.kotlin:kotlin-stdlib-jdk7:${getKotlinVersion()}"
+  implementation "com.nimbusds:nimbus-jose-jwt:9.38-rc3"
+}

modules/expo-bluesky-oauth-client/android/src/main/AndroidManifest.xml

@@ -0,0 +1,2 @@
+<manifest>
+</manifest>

modules/expo-bluesky-oauth-client/android/src/main/java/expo/modules/blueskyoauthclient/CryptoUtil.kt

@@ -0,0 +1,52 @@
+package expo.modules.blueskyoauthclient
+
+import com.nimbusds.jose.Algorithm
+import java.security.KeyPairGenerator
+import java.security.MessageDigest
+import java.security.interfaces.ECPublicKey
+import java.security.interfaces.ECPrivateKey
+import com.nimbusds.jose.jwk.Curve
+import com.nimbusds.jose.jwk.ECKey
+import com.nimbusds.jose.jwk.KeyUse
+import java.util.UUID
+
+class CryptoUtil {
+  fun digest(data: ByteArray): ByteArray {
+    val digest = MessageDigest.getInstance("sha256")
+    return digest.digest(data)
+  }
+
+  fun getRandomValues(byteLength: Int): ByteArray {
+    val random = ByteArray(byteLength)
+    java.security.SecureRandom().nextBytes(random)
+    return random
+  }
+
+  fun generateKeyPair(keyId: String?): Pair<String, String> {
+    val keyIdString = keyId ?: UUID.randomUUID().toString()
+
+    val keyPairGen = KeyPairGenerator.getInstance("EC")
+    keyPairGen.initialize(Curve.P_256.toECParameterSpec())
+    val keyPair = keyPairGen.generateKeyPair()
+
+    val publicKey = keyPair.public as ECPublicKey
+    val privateKey = keyPair.private as ECPrivateKey
+
+    val publicJwk = ECKey.Builder(Curve.P_256, publicKey)
+      .keyUse(KeyUse.SIGNATURE)
+      .algorithm(Algorithm.parse("ES256"))
+      .keyID(keyIdString)
+      .build()
+    val privateJwk = ECKey.Builder(Curve.P_256, publicKey)
+      .privateKey(privateKey)
+      .keyUse(KeyUse.SIGNATURE)
+      .keyID(keyIdString)
+      .algorithm(Algorithm.parse("ES256"))
+      .build()
+
+    return Pair(
+      publicJwk.toString(),
+      privateJwk.toString()
+    )
+  }
+}

modules/expo-bluesky-oauth-client/android/src/main/java/expo/modules/blueskyoauthclient/ExpoBlueskyOAuthClientModule.kt

@@ -0,0 +1,35 @@
+package expo.modules.blueskyoauthclient
+
+import expo.modules.kotlin.modules.Module
+import expo.modules.kotlin.modules.ModuleDefinition
+
+class ExpoBlueskyOAuthClientModule : Module() {
+  override fun definition() = ModuleDefinition {
+    Name("ExpoBlueskyOAuthClient")
+
+    AsyncFunction("digest") { value: ByteArray ->
+      return@AsyncFunction CryptoUtil().digest(value)
+    }
+
+    Function("getRandomValues") { byteLength: Int ->
+      return@Function CryptoUtil().getRandomValues(byteLength)
+    }
+
+    AsyncFunction("generateKeyPair") { keyId: String? ->
+      val res = CryptoUtil().generateKeyPair(keyId)
+
+      return@AsyncFunction mapOf(
+        "publicKey" to res.first,
+        "privateKey" to res.second
+      )
+    }
+
+    AsyncFunction("createJwt") { jwkString: String, headerString: String, payloadString: String ->
+      return@AsyncFunction JWTUtil().createJwt(jwkString, headerString, payloadString)
+    }
+
+    AsyncFunction("verifyJwt") { jwkString: String, tokenString: String, options: String? ->
+      return@AsyncFunction JWTUtil().verifyJwt(jwkString, tokenString, options)
+    }
+  }
+}

modules/expo-bluesky-oauth-client/android/src/main/java/expo/modules/blueskyoauthclient/JWTUtil.kt

@@ -0,0 +1,35 @@
+package expo.modules.blueskyoauthclient
+
+import com.nimbusds.jose.JWSHeader
+import com.nimbusds.jose.crypto.ECDSASigner
+import com.nimbusds.jose.crypto.ECDSAVerifier
+import com.nimbusds.jose.jwk.ECKey
+import com.nimbusds.jwt.JWTClaimsSet
+import com.nimbusds.jwt.SignedJWT
+
+
+class JWTUtil {
+  fun createJwt(jwkString: String, headerString: String, payloadString: String): String {
+    val key = ECKey.parse(jwkString)
+    val header = JWSHeader.parse(headerString)
+    val payload = JWTClaimsSet.parse(payloadString)
+
+    val signer = ECDSASigner(key)
+    val jwt = SignedJWT(header, payload)
+    jwt.sign(signer)
+
+    return jwt.serialize()
+  }
+
+  fun verifyJwt(jwkString: String, tokenString: String, options: String?): Boolean {
+    return try {
+      val key = ECKey.parse(jwkString)
+      val jwt = SignedJWT.parse(tokenString)
+      val verifier = ECDSAVerifier(key)
+
+      jwt.verify(verifier)
+    } catch(e: Exception) {
+      false
+    }
+  }
+}

modules/expo-bluesky-oauth-client/expo-module.config.json

@@ -0,0 +1,9 @@
+{
+  "platforms": ["ios", "tvos", "android", "web"],
+  "ios": {
+    "modules": ["ExpoBlueskyOAuthClientModule"]
+  },
+  "android": {
+    "modules": ["expo.modules.blueskyoauthclient.ExpoBlueskyOAuthClientModule"]
+  }
+}

modules/expo-bluesky-oauth-client/index.ts

@@ -0,0 +1,4 @@
+export * from './src/oauth-client-react-native'
+export * from './src/react-native-crypto-implementation'
+export * from './src/react-native-key'
+export * from './src/react-native-store-with-key'

modules/expo-bluesky-oauth-client/ios/CryptoUtil.swift

@@ -0,0 +1,64 @@
+import CryptoKit
+import JOSESwift
+import ExpoModulesCore
+
+class CryptoUtil {
+  // The equivalent of crypto.subtle.digest() with JS on web
+  public static func digest(data: Data) -> Data {
+    let hash = SHA256.hash(data: data)
+    return Data(hash)
+  }
+
+  public static func getRandomValues(byteLength: Int) -> Data {
+    let bytes = (0..<byteLength).map { _ in UInt8.random(in: UInt8.min...UInt8.max) }
+    return Data(bytes)
+  }
+
+  public static func generateKeyPair() throws -> JWKPair? {
+    let keyIdString = UUID().uuidString
+
+    let privateKey = P256.Signing.PrivateKey()
+    let publicKey = privateKey.publicKey
+
+    let x = publicKey.x963Representation[1..<33].base64URLEncodedString()
+    let y = publicKey.x963Representation[33...].base64URLEncodedString()
+    let d = privateKey.rawRepresentation.base64URLEncodedString()
+
+    let publicJWK = JWK(
+      alg: "ES256".toField(),
+      kty: "EC".toField(),
+      crv: "P-256".toNullableField(),
+      x: x.toNullableField(),
+      y: y.toNullableField(),
+      use: "sig".toNullableField(),
+      kid: keyIdString.toNullableField()
+    )
+    let privateJWK = JWK(
+      alg: "ES256".toField(),
+      kty: "EC".toField(),
+      crv: "P-256".toNullableField(),
+      x: x.toNullableField(),
+      y: y.toNullableField(),
+      d: d.toNullableField(),
+      use: "sig".toNullableField(),
+      kid: keyIdString.toNullableField()
+    )
+
+    return JWKPair(privateKey: privateJWK.toField(), publicKey: publicJWK.toField())
+  }
+}
+
+extension Data {
+  func base64URLEncodedString() -> String {
+    return self.base64EncodedString().replacingOccurrences(of: "+", with: "-").replacingOccurrences(of: "/", with: "_").replacingOccurrences(of: "=", with: "")
+  }
+}
+
+extension String {
+  func toField() -> Field<String> {
+    return Field(wrappedValue: self)
+  }
+  func toNullableField() -> Field<String?> {
+    return Field(wrappedValue: self)
+  }
+}

modules/expo-bluesky-oauth-client/ios/ExpoBlueskyOAuthClient.podspec

@@ -0,0 +1,22 @@
+Pod::Spec.new do |s|
+  s.name           = 'ExpoBlueskyOAuthClient'
+  s.version        = '0.0.1'
+  s.summary        = 'A library of native functions to support Bluesky OAuth in React Native.'
+  s.description    = 'A library of native functions to support Bluesky OAuth in React Native.'
+  s.author         = ''
+  s.homepage       = 'https://github.com/bluesky-social/social-app'
+  s.platforms      = { :ios => '13.4', :tvos => '13.4' }
+  s.source         = { git: '' }
+  s.static_framework = true
+
+  s.dependency 'ExpoModulesCore'
+  s.dependency 'JOSESwift', '~> 2.3'
+
+  # Swift/Objective-C compatibility
+  s.pod_target_xcconfig = {
+    'DEFINES_MODULE' => 'YES',
+    'SWIFT_COMPILATION_MODE' => 'wholemodule'
+  }
+
+  s.source_files = "**/*.{h,m,mm,swift,hpp,cpp}"
+end

modules/expo-bluesky-oauth-client/ios/ExpoBlueskyOAuthClientModule.swift

@@ -0,0 +1,45 @@
+import ExpoModulesCore
+import JOSESwift
+
+public class ExpoBlueskyOAuthClientModule: Module {
+  public func definition() -> ModuleDefinition {
+    Name("ExpoBlueskyOAuthClient")
+
+    AsyncFunction("digest") { (data: Data, promise: Promise) in
+      promise.resolve(CryptoUtil.digest(data: data))
+    }
+
+    // We are going to leave this as sync to line up the APIs. It's fast, so not a big deal.
+    Function("getRandomValues") { (byteLength: Int) in
+      return CryptoUtil.getRandomValues(byteLength: byteLength)
+    }
+
+    AsyncFunction ("generateJwk") { (algo: String?, promise: Promise) in
+      if algo != "ES256" {
+        promise.reject("GenerateKeyError", "Algorithim not supported.")
+        return
+      }
+
+      let keypair = try? CryptoUtil.generateKeyPair()
+
+      guard keypair != nil else {
+        promise.reject("GenerateKeyError", "Error generating JWK.")
+        return
+      }
+
+      promise.resolve(keypair)
+    }
+
+    AsyncFunction("createJwt") { (header: JWTHeader, payload: JWTPayload, jwk: JWK, promise: Promise) in
+      guard let jwt = JWTUtil.createJwt(header: header, payload: payload, jwk: jwk) else {
+        promise.reject("JWTError", "Error creating JWT.")
+        return
+      }
+      promise.resolve(jwt)
+    }
+
+    AsyncFunction("verifyJwt") { (jwk: String, token: String, options: String?, promise: Promise) in
+      promise.resolve(JWTUtil.verifyJwt(jwk, token: token, options: options))
+    }
+  }
+}