NEVISACCESSAPP-5966: added password authenticator with custom policy

src/App.tsx

@@ -11,6 +11,7 @@ import AuthCloudApiRegistrationScreen from './screens/AuthCloudApiRegistrationSc
 import ConfirmationScreen from './screens/ConfirmationScreen';
 import DeviceInformationChangeScreen from './screens/DeviceInformationChangeScreen';
 import HomeScreen from './screens/HomeScreen';
+import PasswordScreen from './screens/PasswordScreen';
 import PinScreen from './screens/PinScreen';
 import ReadQrCodeScreen from './screens/ReadQrCodeScreen';
 import ResultScreen from './screens/ResultScreen';
@@ -49,6 +50,7 @@ export default function App() {
 						component={SelectAuthenticatorScreen}
 					/>
 					<RootStack.Screen name="Pin" component={PinScreen} />
+					<RootStack.Screen name="Password" component={PasswordScreen} />
 					<RootStack.Screen
 						name="DeviceInformationChange"
 						component={DeviceInformationChangeScreen}

src/error/AppError.ts

@@ -77,6 +77,16 @@ export class AppErrorPinAuthenticatorNotFound extends AppError {
 	}
 }
 
+export class AppErrorPasswordAuthenticatorNotFound extends AppError {
+	description: string = i18next.t('appError.passwordAuthenticatorNotFound');
+	cause?: string;
+
+	constructor(cause?: string) {
+		super();
+		this.cause = cause;
+	}
+}
+
 export class AppErrorDeviceInformationNotFound extends AppError {
 	description: string = i18next.t('appError.deviceInformationNotFound');
 	cause?: string;

src/i18n/en/translation.json

@@ -8,6 +8,7 @@
 		"deregister": "Deregister",
 		"deviceInformationChange": "Change Device Information",
 		"pinChange": "PIN Change",
+		"passwordChange": "Password Change",
 		"deleteAuthenticators": "Delete Authenticators",
 		"inBandRegister": "In-Band Register",
 		"identitySuiteOnly": "Identity Suite only"
@@ -53,6 +54,26 @@
 		"pinProtectionStatusDescriptionLocked": "Authenticator is locked.",
 		"pinProtectionStatusDescriptionUnlocked": "Authenticator is unlocked. You have {{remainingRetries}} try left.\nPlease retry in {{coolDown}} seconds."
 	},
+	"password": {
+		"enrollment": {
+			"title": "Create password",
+			"description": "Please define a password."
+		},
+		"verification": {
+			"title": "Verify password",
+			"description": "Please enter your password to complete the process."
+		},
+		"change": {
+			"title": "Change password",
+			"description": "Please define a password."
+		},
+		"placeholder": {
+			"password": "Enter password",
+			"oldPassword": "Enter old password"
+		},
+		"passwordProtectionStatusDescriptionLocked": "Authenticator is locked.",
+		"passwordProtectionStatusDescriptionUnlocked": "Authenticator is unlocked. You have {{remainingRetries}} try left.\nPlease retry in {{coolDown}} seconds."
+	},
 	"transactionConfirmation": {
 		"title": "Transaction Confirmation"
 	},
@@ -91,7 +112,8 @@
 			"faceID": "Face ID",
 			"devicePasscode": "Device Passcode",
 			"fingerprint": "Fingerprint",
-			"touchID": "Touch ID"
+			"touchID": "Touch ID",
+			"password": "Password"
 		},
 		"notPolicyCompliant": "This authentication method cannot be used with your application",
 		"notEnrolled": "Before using the authenticator, enroll it in the phone System Settings"
@@ -105,6 +127,7 @@
 		"deviceInformationChange": "Device Information Change",
 		"payloadDecode": "OOB Payload Decode",
 		"pinChange": "PIN Change",
+		"passwordChange": "Password Change",
 		"localData": "Local Data",
 		"unknown": "Operation",
 		"success": {

src/model/AuthenticatorItem.ts

@@ -16,7 +16,10 @@ export class AuthenticatorItem {
 		this.isPolicyCompliant = isPolicyCompliant;
 		this.isUserEnrolled = isUserEnrolled;
 		this.isEnabled =
-			isPolicyCompliant && (authenticator.aaid === Aaid.PIN.rawValue() || isUserEnrolled);
+			isPolicyCompliant &&
+			(authenticator.aaid === Aaid.PIN.rawValue() ||
+				authenticator.aaid === Aaid.PASSWORD.rawValue() ||
+				isUserEnrolled);
 	}
 }
 

src/model/OperationType.ts

@@ -13,6 +13,7 @@ export enum OperationType {
 	deviceInformationChange,
 	payloadDecode,
 	pinChange,
+	passwordChange,
 	localData,
 	unknown,
 }
@@ -36,6 +37,8 @@ export class OperationTypeUtils {
 				return i18next.t('operation.payloadDecode');
 			case OperationType.pinChange:
 				return i18next.t('operation.pinChange');
+			case OperationType.passwordChange:
+				return i18next.t('operation.passwordChange');
 			case OperationType.localData:
 				return i18next.t('operation.localData');
 			case OperationType.unknown:

src/model/PasswordMode.ts

@@ -0,0 +1,9 @@
+/**
+ * Copyright © 2024 Nevis Security AG. All rights reserved.
+ */
+
+export enum PasswordMode {
+	enrollment,
+	verification,
+	credentialChange,
+}

src/screens/AuthCloudApiRegistrationViewModel.ts

@@ -13,6 +13,7 @@ import { OperationType } from '../model/OperationType';
 import { BiometricUserVerifierImpl } from '../userInteraction/BiometricUserVerifierImpl';
 import { DevicePasscodeUserVerifierImpl } from '../userInteraction/DevicePasscodeUserVerifierImpl';
 import { FingerprintUserVerifierImpl } from '../userInteraction/FingerprintUserVerifierImpl';
+import { PasswordEnrollerImpl } from '../userInteraction/PasswordEnrollerImpl';
 import { PinEnrollerImpl } from '../userInteraction/PinEnrollerImpl';
 import { RegistrationAuthenticatorSelectorImpl } from '../userInteraction/RegistrationAuthenticatorSelectorImpl';
 import { ClientProvider } from '../utility/ClientProvider';
@@ -30,6 +31,7 @@ const useAuthCloudApiRegistrationViewModel = () => {
 			.deviceInformation(DeviceInformationUtils.create())
 			.authenticatorSelector(new RegistrationAuthenticatorSelectorImpl())
 			.pinEnroller(new PinEnrollerImpl())
+			.passwordEnroller(new PasswordEnrollerImpl())
 			.biometricUserVerifier(new BiometricUserVerifierImpl())
 			.devicePasscodeUserVerifier(new DevicePasscodeUserVerifierImpl())
 			.fingerprintUserVerifier(new FingerprintUserVerifierImpl())

src/screens/HomeScreen.tsx

@@ -29,6 +29,7 @@ const HomeScreen = () => {
 		changeDeviceInformation,
 		deleteLocalAuthenticators,
 		changePin,
+		changePassword,
 	} = useHomeViewModel();
 
 	const { t } = useTranslation();
@@ -99,6 +100,7 @@ const HomeScreen = () => {
 						onPress={changeDeviceInformation}
 					/>
 					<OutlinedButton text={t('home.pinChange')} onPress={changePin} />
+					<OutlinedButton text={t('home.passwordChange')} onPress={changePassword} />
 					<OutlinedButton
 						text={t('home.authCloudApiRegistration')}
 						onPress={authCloudApiRegister}

src/screens/HomeViewModel.ts

@@ -18,12 +18,14 @@ import { AppEnvironment, ConfigurationLoader } from '../configuration/Configurat
 import {
 	AppErrorAccountsNotFound,
 	AppErrorDeviceInformationNotFound,
+	AppErrorPasswordAuthenticatorNotFound,
 	AppErrorPinAuthenticatorNotFound,
 } from '../error/AppError';
 import { ErrorHandler } from '../error/ErrorHandler';
 import { AccountItem } from '../model/AccountItem';
 import { OperationType } from '../model/OperationType';
 import * as OutOfBandOperationHandler from '../userInteraction/OutOfBandOperationHandler';
+import { PasswordChangerImpl } from '../userInteraction/PasswordChangerImpl';
 import { PinChangerImpl } from '../userInteraction/PinChangerImpl';
 import { ClientProvider } from '../utility/ClientProvider';
 import * as RootNavigation from '../utility/RootNavigation';
@@ -219,7 +221,9 @@ const useHomeViewModel = () => {
 					);
 				}
 
-				console.log(`Available device info: ${deviceInformation}`);
+				console.log(
+					`Available device info: ${JSON.stringify(deviceInformation, null, ' ')}`
+				);
 				navigation.navigate('DeviceInformationChange', {
 					name: deviceInformation.name,
 				});
@@ -284,16 +288,16 @@ const useHomeViewModel = () => {
 		} else if (eligibleAccounts.length === 1) {
 			// in case that there is only one account, then we can select it automatically
 			console.log('Automatically selecting account for PIN Change');
-			await startPinChange(eligibleAccounts);
+			await startPinChange(eligibleAccounts.at(0)!);
 		} else {
 			// in case that there are multiple eligible accounts then we have to show the account selection screen
 			return selectAccount(OperationType.pinChange);
 		}
 
-		async function startPinChange(accounts: Array<Account>) {
+		async function startPinChange(account: Account) {
 			const client = ClientProvider.getInstance().client;
 			client?.operations.pinChange
-				.username(accounts.at(0)!.username)
+				.username(account.username)
 				.pinChanger(new PinChangerImpl())
 				.onSuccess(() => {
 					console.log('PIN Change succeeded.');
@@ -307,6 +311,56 @@ const useHomeViewModel = () => {
 		}
 	}
 
+	async function changePassword() {
+		// we should only pass the accounts to the account selection that already have a password enrollment
+		const filteredAuthenticators = localAuthenticators.filter((authenticator) => {
+			return authenticator.aaid === Aaid.PASSWORD.rawValue();
+		});
+		const passwordAuthenticator = filteredAuthenticators.at(0);
+		if (!passwordAuthenticator) {
+			return ErrorHandler.handle(
+				OperationType.passwordChange,
+				new AppErrorPasswordAuthenticatorNotFound(
+					'Password change failed, there are no registered password authenticators'
+				)
+			);
+		}
+
+		const userEnrollment = passwordAuthenticator.userEnrollment;
+		const eligibleAccounts = localAccounts.filter((account) => {
+			return userEnrollment.isEnrolled(account.username);
+		});
+		if (eligibleAccounts.length === 0) {
+			return ErrorHandler.handle(
+				OperationType.passwordChange,
+				new AppErrorAccountsNotFound(`Password change failed, no eligible accounts found`)
+			);
+		} else if (eligibleAccounts.length === 1) {
+			// in case that there is only one account, then we can select it automatically
+			console.log('Automatically selecting account for password Change');
+			await startPasswordChange(eligibleAccounts.at(0)!);
+		} else {
+			// in case that there are multiple eligible accounts then we have to show the account selection screen
+			return selectAccount(OperationType.passwordChange);
+		}
+
+		async function startPasswordChange(account: Account) {
+			const client = ClientProvider.getInstance().client;
+			client?.operations.passwordChange
+				.username(account.username)
+				.passwordChanger(new PasswordChangerImpl())
+				.onSuccess(() => {
+					console.log('Password Change succeeded.');
+					RootNavigation.navigate('Result', {
+						operation: OperationType.passwordChange,
+					});
+				})
+				.onError(ErrorHandler.handle.bind(null, OperationType.passwordChange))
+				.execute()
+				.catch(ErrorHandler.handle.bind(null, OperationType.passwordChange));
+		}
+	}
+
 	return {
 		numberOfAccounts,
 		initClient,
@@ -320,6 +374,7 @@ const useHomeViewModel = () => {
 		changeDeviceInformation,
 		deleteLocalAuthenticators,
 		changePin,
+		changePassword,
 	};
 };