Share the platform-neutral Rust mobile contract (#91)

crates/mobile-bridge/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "ironstorage-mobile"
+description = "Shared platform-neutral mobile UniFFI contract"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+publish = false
+
+[features]
+default = []
+watch = []
+
+[dependencies]
+ironstorage = { path = "../storage", default-features = false, features = ["full"] }
+uniffi.workspace = true

crates/mobile-bridge/src/platform.rs

@@ -0,0 +1,441 @@
+//! Mechanical adapters: foreign code performs OS calls, storage owns behavior.
+
+use std::{fmt, sync::Arc, time::Duration};
+
+use ironstorage::{
+    authentication::AuthenticationClock,
+    config::Config,
+    mobile_platform as storage,
+    presentation::{self, ClipboardBackend},
+    repository::SecretBytes,
+    secret_store::{SecretLocator, SecretProtection, SecretStoreBackend, SecretStoreError},
+};
+
+use crate::{
+    MobileAuthentication, MobileAuthenticationFfiError, MobileAuthenticationState, MobileEntryCopy,
+};
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq, uniffi::Error)]
+pub enum MobilePlatformFfiError {
+    InvalidPaths,
+    InvalidCameraFrame,
+    QrNotFound,
+    InvalidQrPayload,
+    InvalidCredentialRequest,
+    ClipboardFailed,
+    Cancelled,
+}
+
+impl fmt::Display for MobilePlatformFfiError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "Mobile platform operation failed: {self:?}")
+    }
+}
+impl std::error::Error for MobilePlatformFfiError {}
+
+#[derive(Clone, uniffi::Record)]
+pub struct MobilePlatformPaths {
+    pub data_root: String,
+    pub cache_root: String,
+}
+
+impl TryFrom<MobilePlatformPaths> for storage::MobilePlatformPaths {
+    type Error = MobilePlatformFfiError;
+    fn try_from(paths: MobilePlatformPaths) -> Result<Self, Self::Error> {
+        Self::new(paths.data_root.into(), paths.cache_root.into())
+            .map_err(|_| MobilePlatformFfiError::InvalidPaths)
+    }
+}
+
+#[derive(Clone, uniffi::Record)]
+pub struct MobilePlatformLayout {
+    pub configuration: String,
+    pub vault: String,
+    pub keys: String,
+    pub cache: String,
+}
+
+#[uniffi::export]
+pub fn mobile_platform_layout(
+    paths: MobilePlatformPaths,
+) -> Result<MobilePlatformLayout, MobilePlatformFfiError> {
+    let paths = storage::MobilePlatformPaths::try_from(paths)?;
+    Ok(MobilePlatformLayout {
+        configuration: paths.configuration().to_string_lossy().into_owned(),
+        vault: paths.vault().to_string_lossy().into_owned(),
+        keys: paths.keys().to_string_lossy().into_owned(),
+        cache: paths.cache().to_string_lossy().into_owned(),
+    })
+}
+
+#[derive(Clone, uniffi::Enum)]
+pub enum MobileSecretLocator {
+    OpenPgpPassphrase {
+        fingerprint: String,
+    },
+    HttpsGitCredential {
+        server_id: String,
+        application_id: String,
+    },
+    SshKeyPassphrase {
+        fingerprint: String,
+    },
+}
+
+impl From<&SecretLocator> for MobileSecretLocator {
+    fn from(locator: &SecretLocator) -> Self {
+        match locator {
+            SecretLocator::OpenPgpPassphrase { fingerprint } => Self::OpenPgpPassphrase {
+                fingerprint: fingerprint.clone(),
+            },
+            SecretLocator::HttpsGitCredential {
+                server_id,
+                application_id,
+            } => Self::HttpsGitCredential {
+                server_id: server_id.clone(),
+                application_id: application_id.clone(),
+            },
+            SecretLocator::SshKeyPassphrase { fingerprint } => Self::SshKeyPassphrase {
+                fingerprint: fingerprint.to_string(),
+            },
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq, uniffi::Enum)]
+pub enum MobileSecretProtection {
+    DeviceUnlocked,
+    RequireUserPresence,
+    BiometryCurrentSet,
+}
+impl From<SecretProtection> for MobileSecretProtection {
+    fn from(value: SecretProtection) -> Self {
+        match value {
+            SecretProtection::DeviceUnlocked => Self::DeviceUnlocked,
+            SecretProtection::RequireUserPresence => Self::RequireUserPresence,
+            SecretProtection::BiometryCurrentSet => Self::BiometryCurrentSet,
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq, uniffi::Error)]
+pub enum MobileSecretError {
+    AlreadyExists,
+    Missing,
+    Locked,
+    Denied,
+    Cancelled,
+    Corrupted,
+    UnsupportedProtection,
+    Unavailable,
+}
+impl fmt::Display for MobileSecretError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "OS secret operation failed: {self:?}")
+    }
+}
+impl std::error::Error for MobileSecretError {}
+impl From<MobileSecretError> for SecretStoreError {
+    fn from(value: MobileSecretError) -> Self {
+        match value {
+            MobileSecretError::AlreadyExists => Self::AlreadyExists,
+            MobileSecretError::Missing => Self::Missing,
+            MobileSecretError::Locked => Self::Locked,
+            MobileSecretError::Denied => Self::Denied,
+            MobileSecretError::Cancelled => Self::Cancelled,
+            MobileSecretError::Corrupted => Self::Corrupted,
+            MobileSecretError::UnsupportedProtection => Self::UnsupportedProtection,
+            MobileSecretError::Unavailable => Self::Unavailable,
+        }
+    }
+}
+
+/// Receives storage-encoded opaque bytes; cannot select accounts, leases or protection.
+#[uniffi::export(rust, foreign)]
+pub trait MobileSecretBackend: Send + Sync {
+    fn create(
+        &self,
+        locator: MobileSecretLocator,
+        protection: MobileSecretProtection,
+        value: Vec<u8>,
+    ) -> Result<(), MobileSecretError>;
+    fn retrieve(
+        &self,
+        locator: MobileSecretLocator,
+        protection: MobileSecretProtection,
+    ) -> Result<Vec<u8>, MobileSecretError>;
+    fn replace(
+        &self,
+        locator: MobileSecretLocator,
+        protection: MobileSecretProtection,
+        value: Vec<u8>,
+    ) -> Result<(), MobileSecretError>;
+    fn delete(
+        &self,
+        locator: MobileSecretLocator,
+        protection: MobileSecretProtection,
+    ) -> Result<(), MobileSecretError>;
+    fn lock(&self) -> Result<(), MobileSecretError>;
+    fn unlock(&self) -> Result<(), MobileSecretError>;
+}
+
+pub(crate) struct SecretBackendAdapter(pub Arc<dyn MobileSecretBackend>);
+impl SecretStoreBackend for SecretBackendAdapter {
+    fn create(
+        &self,
+        locator: &SecretLocator,
+        protection: SecretProtection,
+        value: &[u8],
+    ) -> Result<(), SecretStoreError> {
+        self.0
+            .create(locator.into(), protection.into(), value.to_vec())
+            .map_err(Into::into)
+    }
+    fn retrieve(
+        &self,
+        locator: &SecretLocator,
+        protection: SecretProtection,
+    ) -> Result<SecretBytes, SecretStoreError> {
+        self.0
+            .retrieve(locator.into(), protection.into())
+            .map(SecretBytes::new)
+            .map_err(Into::into)
+    }
+    fn replace(
+        &self,
+        locator: &SecretLocator,
+        protection: SecretProtection,
+        value: &[u8],
+    ) -> Result<(), SecretStoreError> {
+        self.0
+            .replace(locator.into(), protection.into(), value.to_vec())
+            .map_err(Into::into)
+    }
+    fn delete(
+        &self,
+        locator: &SecretLocator,
+        protection: SecretProtection,
+    ) -> Result<(), SecretStoreError> {
+        self.0
+            .delete(locator.into(), protection.into())
+            .map_err(Into::into)
+    }
+    fn lock(&self) -> Result<(), SecretStoreError> {
+        self.0.lock().map_err(Into::into)
+    }
+    fn unlock(&self) -> Result<(), SecretStoreError> {
+        self.0.unlock().map_err(Into::into)
+    }
+}
+
+#[uniffi::export(rust, foreign)]
+pub trait MobileClock: Send + Sync {
+    fn monotonic_milliseconds(&self) -> u64;
+}
+struct ClockAdapter(Arc<dyn MobileClock>);
+impl AuthenticationClock for ClockAdapter {
+    fn now(&self) -> Duration {
+        Duration::from_millis(self.0.monotonic_milliseconds())
+    }
+}
+
+#[uniffi::export]
+pub fn mobile_authentication_with_platform(
+    paths: MobilePlatformPaths,
+    backend: Arc<dyn MobileSecretBackend>,
+    clock: Arc<dyn MobileClock>,
+) -> Result<Arc<MobileAuthentication>, MobileAuthenticationFfiError> {
+    let paths = storage::MobilePlatformPaths::try_from(paths).map_err(|_| {
+        MobileAuthenticationFfiError::Failed {
+            kind: crate::MobileAuthenticationErrorKind::Configuration,
+            title: "Invalid Private Paths".into(),
+            detail: "The OS private roots are invalid.".into(),
+        }
+    })?;
+    let config = Config::load(Some(&paths.configuration())).map_err(|error| {
+        MobileAuthenticationFfiError::Failed {
+            kind: crate::MobileAuthenticationErrorKind::Configuration,
+            title: "Configuration Is Unavailable".into(),
+            detail: error.to_string(),
+        }
+    })?;
+    let authentication = ironstorage::mobile_authentication::MobileAuthentication::with_platform(
+        config,
+        Arc::new(SecretBackendAdapter(backend)),
+        Arc::new(ClockAdapter(clock)),
+    )?;
+    Ok(Arc::new(MobileAuthentication {
+        authentication: Arc::new(authentication),
+    }))
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq, uniffi::Enum)]
+pub enum MobileLifecycleEvent {
+    Foreground,
+    Background,
+    DeviceLocked,
+    UserActivity,
+    Cancel,
+}
+impl From<MobileLifecycleEvent> for storage::MobileLifecycleEvent {
+    fn from(event: MobileLifecycleEvent) -> Self {
+        match event {
+            MobileLifecycleEvent::Foreground => Self::Foreground,
+            MobileLifecycleEvent::Background => Self::Background,
+            MobileLifecycleEvent::DeviceLocked => Self::DeviceLocked,
+            MobileLifecycleEvent::UserActivity => Self::UserActivity,
+            MobileLifecycleEvent::Cancel => Self::Cancel,
+        }
+    }
+}
+#[uniffi::export]
+impl MobileAuthentication {
+    pub fn lifecycle(
+        &self,
+        event: MobileLifecycleEvent,
+    ) -> Result<MobileAuthenticationState, MobileAuthenticationFfiError> {
+        self.authentication
+            .lifecycle(event.into())
+            .map(Into::into)
+            .map_err(Into::into)
+    }
+}
+
+#[derive(Clone, uniffi::Record)]
+pub struct MobileCameraFrame {
+    pub width: u32,
+    pub height: u32,
+    pub row_stride: u32,
+    pub pixel_stride: u32,
+    pub luminance: Vec<u8>,
+}
+#[uniffi::export]
+pub fn decode_mobile_camera_frame(
+    frame: MobileCameraFrame,
+) -> Result<Vec<u8>, MobilePlatformFfiError> {
+    storage::MobileCameraFrame {
+        width: frame.width,
+        height: frame.height,
+        row_stride: frame.row_stride,
+        pixel_stride: frame.pixel_stride,
+        luminance: SecretBytes::new(frame.luminance),
+    }
+    .decode()
+    .map(|payload| payload.expose().to_vec())
+    .map_err(|error| match error {
+        presentation::QrError::NotFound => MobilePlatformFfiError::QrNotFound,
+        presentation::QrError::InvalidPayload => MobilePlatformFfiError::InvalidQrPayload,
+        _ => MobilePlatformFfiError::InvalidCameraFrame,
+    })
+}
+
+#[derive(Clone, uniffi::Enum)]
+pub enum MobileClipboardContent {
+    Text { value: Vec<u8> },
+    EmptyOrNonText,
+}
+#[derive(Clone, Copy, Debug, Eq, PartialEq, uniffi::Enum)]
+pub enum MobileClipboardWait {
+    Elapsed,
+    Cancelled,
+}
+#[derive(Clone, Copy, Debug, Eq, PartialEq, uniffi::Enum)]
+pub enum MobileClipboardDisposition {
+    RestoredPrevious,
+    Cleared,
+    PreservedNewer,
+}
+
+#[uniffi::export(rust, foreign)]
+pub trait MobileClipboard: Send + Sync {
+    fn read(&self) -> Result<MobileClipboardContent, MobilePlatformFfiError>;
+    fn write(&self, value: Vec<u8>) -> Result<(), MobilePlatformFfiError>;
+    fn clear(&self) -> Result<(), MobilePlatformFfiError>;
+    fn wait_for_timeout(&self, milliseconds: u64) -> MobileClipboardWait;
+}
+struct ClipboardAdapter(Arc<dyn MobileClipboard>);
+impl ClipboardBackend for ClipboardAdapter {
+    fn read(&mut self) -> Result<presentation::ClipboardContent, presentation::ClipboardError> {
+        self.0
+            .read()
+            .map(|value| match value {
+                MobileClipboardContent::Text { value } => {
+                    presentation::ClipboardContent::text(value)
+                }
+                MobileClipboardContent::EmptyOrNonText => {
+                    presentation::ClipboardContent::EmptyOrNonText
+                }
+            })
+            .map_err(|_| presentation::ClipboardError::ReadFailed)
+    }
+    fn write(&mut self, value: &SecretBytes) -> Result<(), presentation::ClipboardError> {
+        self.0
+            .write(value.expose().to_vec())
+            .map_err(|_| presentation::ClipboardError::WriteFailed)
+    }
+    fn clear(&mut self) -> Result<(), presentation::ClipboardError> {
+        self.0
+            .clear()
+            .map_err(|_| presentation::ClipboardError::CleanupFailed)
+    }
+}
+#[uniffi::export]
+pub fn copy_mobile_entry(
+    copy: MobileEntryCopy,
+    clipboard: Arc<dyn MobileClipboard>,
+) -> Result<MobileClipboardDisposition, MobilePlatformFfiError> {
+    let timeout = presentation::ClipboardTimeout::new(Duration::from_secs(copy.timeout_seconds))
+        .map_err(|_| MobilePlatformFfiError::ClipboardFailed)?;
+    let mut manager =
+        presentation::ClipboardManager::new(ClipboardAdapter(Arc::clone(&clipboard)), timeout);
+    manager
+        .copy_with(
+            &SecretBytes::new(copy.value.into_bytes()),
+            |duration| match clipboard.wait_for_timeout(duration.as_millis() as u64) {
+                MobileClipboardWait::Elapsed => presentation::ClipboardWait::Elapsed,
+                MobileClipboardWait::Cancelled => presentation::ClipboardWait::Cancelled,
+            },
+        )
+        .map(|result| match result {
+            presentation::ClipboardDisposition::RestoredPrevious => {
+                MobileClipboardDisposition::RestoredPrevious
+            }
+            presentation::ClipboardDisposition::Cleared => MobileClipboardDisposition::Cleared,
+            presentation::ClipboardDisposition::PreservedNewer => {
+                MobileClipboardDisposition::PreservedNewer
+            }
+        })
+        .map_err(|error| {
+            if error == presentation::ClipboardError::Cancelled {
+                MobilePlatformFfiError::Cancelled
+            } else {
+                MobilePlatformFfiError::ClipboardFailed
+            }
+        })
+}
+
+#[derive(Clone, uniffi::Record)]
+pub struct MobileCredentialRequest {
+    pub request_id: String,
+    pub package: String,
+    pub signing_certificate_sha256: String,
+    pub origins: Vec<String>,
+}
+#[uniffi::export]
+pub fn validate_mobile_credential_request(
+    request: MobileCredentialRequest,
+) -> Result<MobileCredentialRequest, MobilePlatformFfiError> {
+    let request = storage::MobileCredentialRequest::new(
+        request.request_id,
+        request.package,
+        request.signing_certificate_sha256,
+        request.origins,
+    )
+    .map_err(|_| MobilePlatformFfiError::InvalidCredentialRequest)?;
+    Ok(MobileCredentialRequest {
+        request_id: request.request_id().to_owned(),
+        package: request.package().to_owned(),
+        signing_certificate_sha256: request.signing_certificate_sha256().to_owned(),
+        origins: request.origins().to_vec(),
+    })
+}