feat: share pubky keys with pubky ring

app/src/main/AndroidManifest.xml

@@ -3,20 +3,17 @@
     xmlns:tools="http://schemas.android.com/tools">
 
     <queries>
-        <package android:name="to.pubky.ring" />
+        <package android:name="app.pubkyring" />
         <intent>
             <action android:name="android.settings.APPLICATION_DETAILS_SETTINGS" />
         </intent>
-        <intent>
-            <action android:name="android.intent.action.VIEW" />
-            <data android:scheme="pubkyauth" />
-        </intent>
     </queries>
 
     <uses-feature
         android:name="android.hardware.camera"
         android:required="false" />
 
+    <uses-permission android:name="app.pubkyring.permission.READ_SHARED_PUBKY" />
     <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
     <uses-permission android:name="android.permission.READ_CLIPBOARD" />
     <uses-permission android:name="android.permission.INTERNET" />
@@ -52,6 +49,11 @@
         android:usesPermissionFlags="neverForLocation"
         tools:targetApi="31" />
 
+    <!-- Guards the read-only pubky ContentProvider; only same-signature apps may hold it. -->
+    <permission
+        android:name="${applicationId}.permission.READ_SHARED_PUBKY"
+        android:protectionLevel="signature" />
+
     <application
         android:name=".App"
         android:allowBackup="false"
@@ -244,6 +246,13 @@
             android:name="com.google.firebase.messaging.default_notification_channel_id"
             android:value="@string/app_notifications_channel_id" />
 
+        <provider
+            android:name=".data.sharedpubky.SharedPubkyProvider"
+            android:authorities="${applicationId}.sharedpubky"
+            android:exported="true"
+            android:grantUriPermissions="false"
+            android:readPermission="${applicationId}.permission.READ_SHARED_PUBKY" />
+
         <provider
             android:name="androidx.core.content.FileProvider"
             android:authorities="${applicationId}.fileprovider"

app/src/main/java/to/bitkit/data/keychain/Keychain.kt

@@ -238,6 +238,7 @@ class Keychain @Inject constructor(
         PAYKIT_PENDING_PAYMENT_PROOFS,
         PAYKIT_PRESENTED_PAYMENT_REQUESTS,
         PUBKY_SECRET_KEY,
+        SHARED_PUBKY_SOURCE,
     }
 }
 

app/src/main/java/to/bitkit/data/sharedpubky/SharedPubkyClient.kt

@@ -0,0 +1,75 @@
+package to.bitkit.data.sharedpubky
+
+import android.content.Context
+import android.content.pm.PackageManager
+import android.net.Uri
+import dagger.hilt.android.qualifiers.ApplicationContext
+import kotlinx.collections.immutable.ImmutableList
+import kotlinx.collections.immutable.toImmutableList
+import kotlinx.coroutines.CoroutineDispatcher
+import kotlinx.coroutines.withContext
+import to.bitkit.data.sharedpubky.SharedPubkyContract.COLUMN_PUBKY
+import to.bitkit.data.sharedpubky.SharedPubkyContract.COLUMN_SECRET_KEY
+import to.bitkit.data.sharedpubky.SharedPubkyContract.PATH_CREDENTIAL
+import to.bitkit.data.sharedpubky.SharedPubkyContract.PATH_IDENTITIES
+import to.bitkit.data.sharedpubky.SharedPubkyContract.RING_AUTHORITY
+import to.bitkit.data.sharedpubky.SharedPubkyContract.RING_PACKAGE
+import to.bitkit.di.IoDispatcher
+import to.bitkit.ext.runSuspendCatching
+import to.bitkit.models.PubkyPublicKeyFormat
+import javax.inject.Inject
+import javax.inject.Singleton
+
+@Singleton
+class SharedPubkyClient @Inject constructor(
+    @ApplicationContext private val context: Context,
+    @IoDispatcher private val ioDispatcher: CoroutineDispatcher,
+) {
+    suspend fun listRingIdentities(): Result<ImmutableList<String>> = withContext(ioDispatcher) {
+        runSuspendCatching {
+            check(isRingProviderTrusted()) { "Ring provider unavailable" }
+
+            val uri = Uri.parse("content://$RING_AUTHORITY/$PATH_IDENTITIES")
+            val cursor = requireNotNull(context.contentResolver.query(uri, null, null, null, null)) {
+                "Ring identities query returned no cursor"
+            }
+            cursor.use {
+                buildList {
+                    val column = it.getColumnIndexOrThrow(COLUMN_PUBKY)
+                    while (it.moveToNext()) {
+                        it.getString(column)?.let(::add)
+                    }
+                }
+            }.toImmutableList()
+        }
+    }
+
+    suspend fun ringCredential(pubky: String): Result<String> = withContext(ioDispatcher) {
+        runSuspendCatching {
+            requireNotNull(readCredential(pubky)) { "Ring credential unavailable" }
+        }
+    }
+
+    internal fun readCredential(pubky: String): String? {
+        if (!isRingProviderTrusted()) return null
+
+        val uri = Uri.parse("content://$RING_AUTHORITY/$PATH_IDENTITIES/$pubky/$PATH_CREDENTIAL")
+        val cursor = requireNotNull(context.contentResolver.query(uri, null, null, null, null)) {
+            "Ring credential query returned no cursor"
+        }
+        return cursor.use {
+            if (it.count != 1 || !it.moveToFirst()) return null
+            val rowPubky = it.getString(it.getColumnIndexOrThrow(COLUMN_PUBKY))
+            val secretKeyHex = it.getString(it.getColumnIndexOrThrow(COLUMN_SECRET_KEY)).orEmpty()
+
+            if (!PubkyPublicKeyFormat.matches(rowPubky, pubky)) return null
+            secretKeyHex.takeIf { hex -> SharedPubkyContract.isValidSecret(hex, pubky) }
+        }
+    }
+
+    private fun isRingProviderTrusted(): Boolean {
+        val packageManager = context.packageManager
+        return packageManager.resolveContentProvider(RING_AUTHORITY, 0)?.packageName == RING_PACKAGE &&
+            packageManager.checkSignatures(context.packageName, RING_PACKAGE) == PackageManager.SIGNATURE_MATCH
+    }
+}

app/src/main/java/to/bitkit/data/sharedpubky/SharedPubkyContract.kt

@@ -0,0 +1,50 @@
+package to.bitkit.data.sharedpubky
+
+import to.bitkit.models.PubkyPublicKeyFormat
+import to.bitkit.services.PaykitSdkService
+
+private const val PUBKY_PREFIX = "pubky"
+private val SECRET_KEY_PATTERN = Regex("[0-9a-f]{64}")
+
+object SharedPubkyContract {
+    /** Appended to an applicationId to form its shared pubky provider authority, same as in Pubky Ring. */
+    const val AUTHORITY_SUFFIX = ".sharedpubky"
+
+    /** Provider path listing the app's pubkys, one [COLUMN_PUBKY] row each. */
+    const val PATH_IDENTITIES = "v1/identities"
+
+    /** Final segment of `v1/identities/<pubky>/credential`, which returns that pubky's secret key. */
+    const val PATH_CREDENTIAL = "credential"
+
+    /** Public key column of both the identities and credential rows. */
+    const val COLUMN_PUBKY = "pubky"
+
+    /** Secret key column of the credential row, as 64 lowercase hex characters. */
+    const val COLUMN_SECRET_KEY = "secret_key"
+
+    /** Pubky Ring's Android applicationId. */
+    const val RING_PACKAGE = "app.pubkyring"
+
+    /** Authority of Pubky Ring's shared pubky provider. */
+    const val RING_AUTHORITY = RING_PACKAGE + AUTHORITY_SUFFIX
+
+    /** Prefix of the stored `app.pubkyring:<pubky>` source reference that marks an adopted Ring pubky. */
+    const val RING_SOURCE_PREFIX = "$RING_PACKAGE:"
+
+    fun isValidSecret(
+        secretKeyHex: String,
+        pubky: String,
+        derivePublicKey: (String) -> String = PaykitSdkService::publicKeyFromSecret,
+    ): Boolean = PubkyPublicKeyFormat.matches(pubkyFromSecret(secretKeyHex, derivePublicKey), pubky)
+
+    internal fun pubkyFromSecret(
+        secretKeyHex: String,
+        derivePublicKey: (String) -> String,
+    ): String? {
+        if (!SECRET_KEY_PATTERN.matches(secretKeyHex)) return null
+        return runCatching { derivePublicKey(secretKeyHex) }
+            .getOrNull()
+            ?.let(PubkyPublicKeyFormat::normalized)
+            ?.removePrefix(PUBKY_PREFIX)
+    }
+}

app/src/main/java/to/bitkit/data/sharedpubky/SharedPubkyProvider.kt

@@ -0,0 +1,116 @@
+package to.bitkit.data.sharedpubky
+
+import android.content.ContentProvider
+import android.content.ContentValues
+import android.content.UriMatcher
+import android.content.pm.PackageManager
+import android.database.Cursor
+import android.database.MatrixCursor
+import android.net.Uri
+import android.os.Binder
+import dagger.hilt.EntryPoint
+import dagger.hilt.InstallIn
+import dagger.hilt.android.EntryPointAccessors
+import dagger.hilt.components.SingletonComponent
+import to.bitkit.data.keychain.Keychain
+import to.bitkit.data.sharedpubky.SharedPubkyContract.AUTHORITY_SUFFIX
+import to.bitkit.data.sharedpubky.SharedPubkyContract.COLUMN_PUBKY
+import to.bitkit.data.sharedpubky.SharedPubkyContract.COLUMN_SECRET_KEY
+import to.bitkit.data.sharedpubky.SharedPubkyContract.PATH_CREDENTIAL
+import to.bitkit.data.sharedpubky.SharedPubkyContract.PATH_IDENTITIES
+import to.bitkit.models.PubkyPublicKeyFormat
+import to.bitkit.services.PaykitSdkService
+import to.bitkit.utils.Logger
+
+private const val TAG = "SharedPubkyProvider"
+private const val MATCH_IDENTITIES = 1
+private const val MATCH_CREDENTIAL = 2
+private const val MIME_SUBTYPE = "vnd.to.bitkit.sharedpubky"
+private const val PUBKY_PATH_INDEX = 2
+
+class SharedPubkyProvider : ContentProvider() {
+    internal var keychainProvider: () -> Keychain? = {
+        context?.applicationContext?.let {
+            EntryPointAccessors.fromApplication(it, SharedPubkyEntryPoint::class.java).keychain()
+        }
+    }
+
+    internal var derivePublicKey: (String) -> String = PaykitSdkService::publicKeyFromSecret
+
+    private val uriMatcher by lazy {
+        UriMatcher(UriMatcher.NO_MATCH).apply {
+            val authority = "${context?.packageName}$AUTHORITY_SUFFIX"
+            addURI(authority, PATH_IDENTITIES, MATCH_IDENTITIES)
+            addURI(authority, "$PATH_IDENTITIES/*/$PATH_CREDENTIAL", MATCH_CREDENTIAL)
+        }
+    }
+
+    override fun onCreate() = true
+
+    override fun query(
+        uri: Uri,
+        projection: Array<out String>?,
+        selection: String?,
+        selectionArgs: Array<out String>?,
+        sortOrder: String?,
+    ): Cursor? {
+        if (!isCallerTrusted(Binder.getCallingUid())) throw SecurityException("Caller signature mismatch")
+
+        val match = uriMatcher.match(uri)
+        val cursor = when (match) {
+            MATCH_IDENTITIES -> MatrixCursor(arrayOf(COLUMN_PUBKY))
+            MATCH_CREDENTIAL -> MatrixCursor(arrayOf(COLUMN_PUBKY, COLUMN_SECRET_KEY))
+            else -> return null
+        }
+
+        val secretKeyHex = loadSecretKey().getOrElse { return null } ?: return cursor
+        val pubky = SharedPubkyContract.pubkyFromSecret(secretKeyHex, derivePublicKey) ?: return cursor
+
+        when (match) {
+            MATCH_IDENTITIES -> cursor.addRow(arrayOf(pubky))
+            MATCH_CREDENTIAL -> if (PubkyPublicKeyFormat.matches(uri.pathSegments.getOrNull(PUBKY_PATH_INDEX), pubky)) {
+                cursor.addRow(arrayOf(pubky, secretKeyHex))
+            }
+        }
+        Logger.debug("Served shared pubky '${PubkyPublicKeyFormat.redacted(pubky)}'", context = TAG)
+
+        return cursor
+    }
+
+    override fun getType(uri: Uri): String? = when (uriMatcher.match(uri)) {
+        MATCH_IDENTITIES -> "vnd.android.cursor.dir/$MIME_SUBTYPE"
+        MATCH_CREDENTIAL -> "vnd.android.cursor.item/$MIME_SUBTYPE"
+        else -> null
+    }
+
+    override fun insert(uri: Uri, values: ContentValues?): Uri = throw UnsupportedOperationException()
+
+    override fun update(
+        uri: Uri,
+        values: ContentValues?,
+        selection: String?,
+        selectionArgs: Array<out String>?,
+    ): Int = throw UnsupportedOperationException()
+
+    override fun delete(uri: Uri, selection: String?, selectionArgs: Array<out String>?): Int =
+        throw UnsupportedOperationException()
+
+    internal fun isCallerTrusted(uid: Int): Boolean {
+        val context = context ?: return false
+        val packageManager = context.packageManager
+        val callerPackages = packageManager.getPackagesForUid(uid).orEmpty()
+
+        return callerPackages.isNotEmpty() && callerPackages.all {
+            packageManager.checkSignatures(context.packageName, it) == PackageManager.SIGNATURE_MATCH
+        }
+    }
+
+    private fun loadSecretKey(): Result<String?> =
+        runCatching { keychainProvider()?.loadString(Keychain.Key.PUBKY_SECRET_KEY.name)?.takeIf { it.isNotBlank() } }
+}
+
+@EntryPoint
+@InstallIn(SingletonComponent::class)
+interface SharedPubkyEntryPoint {
+    fun keychain(): Keychain
+}

app/src/main/java/to/bitkit/models/BackupPayloads.kt

@@ -42,14 +42,14 @@ data class MetadataBackupV1(
 @Serializable
 data class PubkySessionBackupV1(
     val kind: PubkySessionBackupKind,
-    val sessionSecret: String? = null,
 )
 
 @Serializable
 enum class PubkySessionBackupKind {
     @SerialName("localSeed")
     LocalSeed,
 
+    /** Legacy: sessions imported through the removed Pubky Ring relay flow; restored as no identity. */
     @SerialName("externalSession")
     ExternalSession,
 }