442 lines
14 KiB
Rust
442 lines
14 KiB
Rust
//! Mechanical adapters: foreign code performs OS calls, storage owns behavior.
|
|
|
|
use std::{fmt, sync::Arc, time::Duration};
|
|
|
|
use ironstorage::{
|
|
authentication::AuthenticationClock,
|
|
config::Config,
|
|
mobile_platform as storage,
|
|
presentation::{self, ClipboardBackend},
|
|
repository::SecretBytes,
|
|
secret_store::{SecretLocator, SecretProtection, SecretStoreBackend, SecretStoreError},
|
|
};
|
|
|
|
use crate::{
|
|
MobileAuthentication, MobileAuthenticationFfiError, MobileAuthenticationState, MobileEntryCopy,
|
|
};
|
|
|
|
#[derive(Clone, Copy, Debug, Eq, PartialEq, uniffi::Error)]
|
|
pub enum MobilePlatformFfiError {
|
|
InvalidPaths,
|
|
InvalidCameraFrame,
|
|
QrNotFound,
|
|
InvalidQrPayload,
|
|
InvalidCredentialRequest,
|
|
ClipboardFailed,
|
|
Cancelled,
|
|
}
|
|
|
|
impl fmt::Display for MobilePlatformFfiError {
|
|
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
|
|
write!(f, "Mobile platform operation failed: {self:?}")
|
|
}
|
|
}
|
|
impl std::error::Error for MobilePlatformFfiError {}
|
|
|
|
#[derive(Clone, uniffi::Record)]
|
|
pub struct MobilePlatformPaths {
|
|
pub data_root: String,
|
|
pub cache_root: String,
|
|
}
|
|
|
|
impl TryFrom<MobilePlatformPaths> for storage::MobilePlatformPaths {
|
|
type Error = MobilePlatformFfiError;
|
|
fn try_from(paths: MobilePlatformPaths) -> Result<Self, Self::Error> {
|
|
Self::new(paths.data_root.into(), paths.cache_root.into())
|
|
.map_err(|_| MobilePlatformFfiError::InvalidPaths)
|
|
}
|
|
}
|
|
|
|
#[derive(Clone, uniffi::Record)]
|
|
pub struct MobilePlatformLayout {
|
|
pub configuration: String,
|
|
pub vault: String,
|
|
pub keys: String,
|
|
pub cache: String,
|
|
}
|
|
|
|
#[uniffi::export]
|
|
pub fn mobile_platform_layout(
|
|
paths: MobilePlatformPaths,
|
|
) -> Result<MobilePlatformLayout, MobilePlatformFfiError> {
|
|
let paths = storage::MobilePlatformPaths::try_from(paths)?;
|
|
Ok(MobilePlatformLayout {
|
|
configuration: paths.configuration().to_string_lossy().into_owned(),
|
|
vault: paths.vault().to_string_lossy().into_owned(),
|
|
keys: paths.keys().to_string_lossy().into_owned(),
|
|
cache: paths.cache().to_string_lossy().into_owned(),
|
|
})
|
|
}
|
|
|
|
#[derive(Clone, uniffi::Enum)]
|
|
pub enum MobileSecretLocator {
|
|
OpenPgpPassphrase {
|
|
fingerprint: String,
|
|
},
|
|
HttpsGitCredential {
|
|
server_id: String,
|
|
application_id: String,
|
|
},
|
|
SshKeyPassphrase {
|
|
fingerprint: String,
|
|
},
|
|
}
|
|
|
|
impl From<&SecretLocator> for MobileSecretLocator {
|
|
fn from(locator: &SecretLocator) -> Self {
|
|
match locator {
|
|
SecretLocator::OpenPgpPassphrase { fingerprint } => Self::OpenPgpPassphrase {
|
|
fingerprint: fingerprint.clone(),
|
|
},
|
|
SecretLocator::HttpsGitCredential {
|
|
server_id,
|
|
application_id,
|
|
} => Self::HttpsGitCredential {
|
|
server_id: server_id.clone(),
|
|
application_id: application_id.clone(),
|
|
},
|
|
SecretLocator::SshKeyPassphrase { fingerprint } => Self::SshKeyPassphrase {
|
|
fingerprint: fingerprint.to_string(),
|
|
},
|
|
}
|
|
}
|
|
}
|
|
|
|
#[derive(Clone, Copy, Debug, Eq, PartialEq, uniffi::Enum)]
|
|
pub enum MobileSecretProtection {
|
|
DeviceUnlocked,
|
|
RequireUserPresence,
|
|
BiometryCurrentSet,
|
|
}
|
|
impl From<SecretProtection> for MobileSecretProtection {
|
|
fn from(value: SecretProtection) -> Self {
|
|
match value {
|
|
SecretProtection::DeviceUnlocked => Self::DeviceUnlocked,
|
|
SecretProtection::RequireUserPresence => Self::RequireUserPresence,
|
|
SecretProtection::BiometryCurrentSet => Self::BiometryCurrentSet,
|
|
}
|
|
}
|
|
}
|
|
|
|
#[derive(Clone, Copy, Debug, Eq, PartialEq, uniffi::Error)]
|
|
pub enum MobileSecretError {
|
|
AlreadyExists,
|
|
Missing,
|
|
Locked,
|
|
Denied,
|
|
Cancelled,
|
|
Corrupted,
|
|
UnsupportedProtection,
|
|
Unavailable,
|
|
}
|
|
impl fmt::Display for MobileSecretError {
|
|
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
|
|
write!(f, "OS secret operation failed: {self:?}")
|
|
}
|
|
}
|
|
impl std::error::Error for MobileSecretError {}
|
|
impl From<MobileSecretError> for SecretStoreError {
|
|
fn from(value: MobileSecretError) -> Self {
|
|
match value {
|
|
MobileSecretError::AlreadyExists => Self::AlreadyExists,
|
|
MobileSecretError::Missing => Self::Missing,
|
|
MobileSecretError::Locked => Self::Locked,
|
|
MobileSecretError::Denied => Self::Denied,
|
|
MobileSecretError::Cancelled => Self::Cancelled,
|
|
MobileSecretError::Corrupted => Self::Corrupted,
|
|
MobileSecretError::UnsupportedProtection => Self::UnsupportedProtection,
|
|
MobileSecretError::Unavailable => Self::Unavailable,
|
|
}
|
|
}
|
|
}
|
|
|
|
/// Receives storage-encoded opaque bytes; cannot select accounts, leases or protection.
|
|
#[uniffi::export(rust, foreign)]
|
|
pub trait MobileSecretBackend: Send + Sync {
|
|
fn create(
|
|
&self,
|
|
locator: MobileSecretLocator,
|
|
protection: MobileSecretProtection,
|
|
value: Vec<u8>,
|
|
) -> Result<(), MobileSecretError>;
|
|
fn retrieve(
|
|
&self,
|
|
locator: MobileSecretLocator,
|
|
protection: MobileSecretProtection,
|
|
) -> Result<Vec<u8>, MobileSecretError>;
|
|
fn replace(
|
|
&self,
|
|
locator: MobileSecretLocator,
|
|
protection: MobileSecretProtection,
|
|
value: Vec<u8>,
|
|
) -> Result<(), MobileSecretError>;
|
|
fn delete(
|
|
&self,
|
|
locator: MobileSecretLocator,
|
|
protection: MobileSecretProtection,
|
|
) -> Result<(), MobileSecretError>;
|
|
fn lock(&self) -> Result<(), MobileSecretError>;
|
|
fn unlock(&self) -> Result<(), MobileSecretError>;
|
|
}
|
|
|
|
pub(crate) struct SecretBackendAdapter(pub Arc<dyn MobileSecretBackend>);
|
|
impl SecretStoreBackend for SecretBackendAdapter {
|
|
fn create(
|
|
&self,
|
|
locator: &SecretLocator,
|
|
protection: SecretProtection,
|
|
value: &[u8],
|
|
) -> Result<(), SecretStoreError> {
|
|
self.0
|
|
.create(locator.into(), protection.into(), value.to_vec())
|
|
.map_err(Into::into)
|
|
}
|
|
fn retrieve(
|
|
&self,
|
|
locator: &SecretLocator,
|
|
protection: SecretProtection,
|
|
) -> Result<SecretBytes, SecretStoreError> {
|
|
self.0
|
|
.retrieve(locator.into(), protection.into())
|
|
.map(SecretBytes::new)
|
|
.map_err(Into::into)
|
|
}
|
|
fn replace(
|
|
&self,
|
|
locator: &SecretLocator,
|
|
protection: SecretProtection,
|
|
value: &[u8],
|
|
) -> Result<(), SecretStoreError> {
|
|
self.0
|
|
.replace(locator.into(), protection.into(), value.to_vec())
|
|
.map_err(Into::into)
|
|
}
|
|
fn delete(
|
|
&self,
|
|
locator: &SecretLocator,
|
|
protection: SecretProtection,
|
|
) -> Result<(), SecretStoreError> {
|
|
self.0
|
|
.delete(locator.into(), protection.into())
|
|
.map_err(Into::into)
|
|
}
|
|
fn lock(&self) -> Result<(), SecretStoreError> {
|
|
self.0.lock().map_err(Into::into)
|
|
}
|
|
fn unlock(&self) -> Result<(), SecretStoreError> {
|
|
self.0.unlock().map_err(Into::into)
|
|
}
|
|
}
|
|
|
|
#[uniffi::export(rust, foreign)]
|
|
pub trait MobileClock: Send + Sync {
|
|
fn monotonic_milliseconds(&self) -> u64;
|
|
}
|
|
struct ClockAdapter(Arc<dyn MobileClock>);
|
|
impl AuthenticationClock for ClockAdapter {
|
|
fn now(&self) -> Duration {
|
|
Duration::from_millis(self.0.monotonic_milliseconds())
|
|
}
|
|
}
|
|
|
|
#[uniffi::export]
|
|
pub fn mobile_authentication_with_platform(
|
|
paths: MobilePlatformPaths,
|
|
backend: Arc<dyn MobileSecretBackend>,
|
|
clock: Arc<dyn MobileClock>,
|
|
) -> Result<Arc<MobileAuthentication>, MobileAuthenticationFfiError> {
|
|
let paths = storage::MobilePlatformPaths::try_from(paths).map_err(|_| {
|
|
MobileAuthenticationFfiError::Failed {
|
|
kind: crate::MobileAuthenticationErrorKind::Configuration,
|
|
title: "Invalid Private Paths".into(),
|
|
detail: "The OS private roots are invalid.".into(),
|
|
}
|
|
})?;
|
|
let config = Config::load(Some(&paths.configuration())).map_err(|error| {
|
|
MobileAuthenticationFfiError::Failed {
|
|
kind: crate::MobileAuthenticationErrorKind::Configuration,
|
|
title: "Configuration Is Unavailable".into(),
|
|
detail: error.to_string(),
|
|
}
|
|
})?;
|
|
let authentication = ironstorage::mobile_authentication::MobileAuthentication::with_platform(
|
|
config,
|
|
Arc::new(SecretBackendAdapter(backend)),
|
|
Arc::new(ClockAdapter(clock)),
|
|
)?;
|
|
Ok(Arc::new(MobileAuthentication {
|
|
authentication: Arc::new(authentication),
|
|
}))
|
|
}
|
|
|
|
#[derive(Clone, Copy, Debug, Eq, PartialEq, uniffi::Enum)]
|
|
pub enum MobileLifecycleEvent {
|
|
Foreground,
|
|
Background,
|
|
DeviceLocked,
|
|
UserActivity,
|
|
Cancel,
|
|
}
|
|
impl From<MobileLifecycleEvent> for storage::MobileLifecycleEvent {
|
|
fn from(event: MobileLifecycleEvent) -> Self {
|
|
match event {
|
|
MobileLifecycleEvent::Foreground => Self::Foreground,
|
|
MobileLifecycleEvent::Background => Self::Background,
|
|
MobileLifecycleEvent::DeviceLocked => Self::DeviceLocked,
|
|
MobileLifecycleEvent::UserActivity => Self::UserActivity,
|
|
MobileLifecycleEvent::Cancel => Self::Cancel,
|
|
}
|
|
}
|
|
}
|
|
#[uniffi::export]
|
|
impl MobileAuthentication {
|
|
pub fn lifecycle(
|
|
&self,
|
|
event: MobileLifecycleEvent,
|
|
) -> Result<MobileAuthenticationState, MobileAuthenticationFfiError> {
|
|
self.authentication
|
|
.lifecycle(event.into())
|
|
.map(Into::into)
|
|
.map_err(Into::into)
|
|
}
|
|
}
|
|
|
|
#[derive(Clone, uniffi::Record)]
|
|
pub struct MobileCameraFrame {
|
|
pub width: u32,
|
|
pub height: u32,
|
|
pub row_stride: u32,
|
|
pub pixel_stride: u32,
|
|
pub luminance: Vec<u8>,
|
|
}
|
|
#[uniffi::export]
|
|
pub fn decode_mobile_camera_frame(
|
|
frame: MobileCameraFrame,
|
|
) -> Result<Vec<u8>, MobilePlatformFfiError> {
|
|
storage::MobileCameraFrame {
|
|
width: frame.width,
|
|
height: frame.height,
|
|
row_stride: frame.row_stride,
|
|
pixel_stride: frame.pixel_stride,
|
|
luminance: SecretBytes::new(frame.luminance),
|
|
}
|
|
.decode()
|
|
.map(|payload| payload.expose().to_vec())
|
|
.map_err(|error| match error {
|
|
presentation::QrError::NotFound => MobilePlatformFfiError::QrNotFound,
|
|
presentation::QrError::InvalidPayload => MobilePlatformFfiError::InvalidQrPayload,
|
|
_ => MobilePlatformFfiError::InvalidCameraFrame,
|
|
})
|
|
}
|
|
|
|
#[derive(Clone, uniffi::Enum)]
|
|
pub enum MobileClipboardContent {
|
|
Text { value: Vec<u8> },
|
|
EmptyOrNonText,
|
|
}
|
|
#[derive(Clone, Copy, Debug, Eq, PartialEq, uniffi::Enum)]
|
|
pub enum MobileClipboardWait {
|
|
Elapsed,
|
|
Cancelled,
|
|
}
|
|
#[derive(Clone, Copy, Debug, Eq, PartialEq, uniffi::Enum)]
|
|
pub enum MobileClipboardDisposition {
|
|
RestoredPrevious,
|
|
Cleared,
|
|
PreservedNewer,
|
|
}
|
|
|
|
#[uniffi::export(rust, foreign)]
|
|
pub trait MobileClipboard: Send + Sync {
|
|
fn read(&self) -> Result<MobileClipboardContent, MobilePlatformFfiError>;
|
|
fn write(&self, value: Vec<u8>) -> Result<(), MobilePlatformFfiError>;
|
|
fn clear(&self) -> Result<(), MobilePlatformFfiError>;
|
|
fn wait_for_timeout(&self, milliseconds: u64) -> MobileClipboardWait;
|
|
}
|
|
struct ClipboardAdapter(Arc<dyn MobileClipboard>);
|
|
impl ClipboardBackend for ClipboardAdapter {
|
|
fn read(&mut self) -> Result<presentation::ClipboardContent, presentation::ClipboardError> {
|
|
self.0
|
|
.read()
|
|
.map(|value| match value {
|
|
MobileClipboardContent::Text { value } => {
|
|
presentation::ClipboardContent::text(value)
|
|
}
|
|
MobileClipboardContent::EmptyOrNonText => {
|
|
presentation::ClipboardContent::EmptyOrNonText
|
|
}
|
|
})
|
|
.map_err(|_| presentation::ClipboardError::ReadFailed)
|
|
}
|
|
fn write(&mut self, value: &SecretBytes) -> Result<(), presentation::ClipboardError> {
|
|
self.0
|
|
.write(value.expose().to_vec())
|
|
.map_err(|_| presentation::ClipboardError::WriteFailed)
|
|
}
|
|
fn clear(&mut self) -> Result<(), presentation::ClipboardError> {
|
|
self.0
|
|
.clear()
|
|
.map_err(|_| presentation::ClipboardError::CleanupFailed)
|
|
}
|
|
}
|
|
#[uniffi::export]
|
|
pub fn copy_mobile_entry(
|
|
copy: MobileEntryCopy,
|
|
clipboard: Arc<dyn MobileClipboard>,
|
|
) -> Result<MobileClipboardDisposition, MobilePlatformFfiError> {
|
|
let timeout = presentation::ClipboardTimeout::new(Duration::from_secs(copy.timeout_seconds))
|
|
.map_err(|_| MobilePlatformFfiError::ClipboardFailed)?;
|
|
let mut manager =
|
|
presentation::ClipboardManager::new(ClipboardAdapter(Arc::clone(&clipboard)), timeout);
|
|
manager
|
|
.copy_with(
|
|
&SecretBytes::new(copy.value.into_bytes()),
|
|
|duration| match clipboard.wait_for_timeout(duration.as_millis() as u64) {
|
|
MobileClipboardWait::Elapsed => presentation::ClipboardWait::Elapsed,
|
|
MobileClipboardWait::Cancelled => presentation::ClipboardWait::Cancelled,
|
|
},
|
|
)
|
|
.map(|result| match result {
|
|
presentation::ClipboardDisposition::RestoredPrevious => {
|
|
MobileClipboardDisposition::RestoredPrevious
|
|
}
|
|
presentation::ClipboardDisposition::Cleared => MobileClipboardDisposition::Cleared,
|
|
presentation::ClipboardDisposition::PreservedNewer => {
|
|
MobileClipboardDisposition::PreservedNewer
|
|
}
|
|
})
|
|
.map_err(|error| {
|
|
if error == presentation::ClipboardError::Cancelled {
|
|
MobilePlatformFfiError::Cancelled
|
|
} else {
|
|
MobilePlatformFfiError::ClipboardFailed
|
|
}
|
|
})
|
|
}
|
|
|
|
#[derive(Clone, uniffi::Record)]
|
|
pub struct MobileCredentialRequest {
|
|
pub request_id: String,
|
|
pub package: String,
|
|
pub signing_certificate_sha256: String,
|
|
pub origins: Vec<String>,
|
|
}
|
|
#[uniffi::export]
|
|
pub fn validate_mobile_credential_request(
|
|
request: MobileCredentialRequest,
|
|
) -> Result<MobileCredentialRequest, MobilePlatformFfiError> {
|
|
let request = storage::MobileCredentialRequest::new(
|
|
request.request_id,
|
|
request.package,
|
|
request.signing_certificate_sha256,
|
|
request.origins,
|
|
)
|
|
.map_err(|_| MobilePlatformFfiError::InvalidCredentialRequest)?;
|
|
Ok(MobileCredentialRequest {
|
|
request_id: request.request_id().to_owned(),
|
|
package: request.package().to_owned(),
|
|
signing_certificate_sha256: request.signing_certificate_sha256().to_owned(),
|
|
origins: request.origins().to_vec(),
|
|
})
|
|
}
|